samba-test-4.19.8+git.435.78ced6cf30d-150600.3.21.1<>, @hp9|/cC2Q]Q}2w@)=qu)JEl %x-v4r2G0݉CܹF+긶cQJ1Vgi\yD:1og`zgOW@s^=V6dOQLE JCA Ɍ]QLNo^TA^I݁&n>οܨ0HP!SOnEX=oW)HӄX;j}-uIQ\~>@?d ( 6 b -AX^h     *p 9y(:8:(9?X(:S (>X@gFvGHIX Y\h]^Sbc0defluvwxyz(8<BCsamba-test4.19.8+git.435.78ced6cf30d150600.3.21.1Testing tools for Samba servers and clientssamba-test provides testing tools for both the server and client packages of Samba.hh03-ch2a^SUSE Linux Enterprise 15SUSE LLC GPL-3.0-or-laterhttps://www.suse.com/Applications/Systemhttps://www.samba.org/linuxx86_64B(Hh@AH WՁ큤hhhhhhhבhבhבh׍hבhבh׎h׎ce8695d9dd87f4ce8c59d4fb3aff26c84707ed4f4ea6da5b373ad7a54b8bc8c46eb3f26a225ead1b4e98d2f23c8ffc665e1ea6cfd6289803e27d3cb7b8b6821c3d0762ca3dcf2e8e6f8390f70f361d31f4f95ee1935c5e09f83f8e776c543464cb8436e7acc45f79a9d1aa66adbbfb540ea474628f411dad590e8eda986a68b634157efe083fe7d134d77c953512d537332e93dd76cdd9a16dff2373cbec481ca14d9255fea48155b033b9c15cec1463c956d1e0d0acecd37748b994415edcaa99edb6394f7f0d1953f7f1ed46a26e7407640affb4fbe5a52c71c77e88cf254fceea340e463849b14ce72b3a4b32b3ae756cf981d490ddd69f8eb17b3414ac8e435405eca06f4a24358cc1b3641c15f9a5bd5268f631bfad264bccc8a05b86886aac5e99dfe5b2489592e6a01f2ef44084354af3ba1a1a423254b42d9758a25cd19f9937cd854c08ce90ab4b5c4dcc7df1ce5bbd26596f042e10e78a0782a8d5d4bc12ef27d3a49ab1371242832e20cc50c9f4afa6efd321f05cab57e5feeed97fffc1ccdd02aac8458b57b86a15e6b4e5b47c8053e4f1b99516dea8754d04e06d09ae414c733bd6e9ea1c3272c525ee7831e23ae493dd75bd47e5ebfc9588d6rootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootsamba-4.19.8+git.435.78ced6cf30d-150600.3.21.1.src.rpmsamba-testsamba-test(x86-64)@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    /sbin/ldconfig/sbin/ldconfiglibLIBWBCLIENT-OLD-samba4.so()(64bit)libLIBWBCLIENT-OLD-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libMESSAGING-SEND-samba4.so()(64bit)libMESSAGING-SEND-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libMESSAGING-samba4.so()(64bit)libMESSAGING-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libRPC-SERVER-LOOP-samba4.so()(64bit)libRPC-SERVER-LOOP-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libads-samba4.so()(64bit)libads-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libasn1util-samba4.so()(64bit)libasn1util-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libauth-samba4.so()(64bit)libauth-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libauthkrb5-samba4.so()(64bit)libauthkrb5-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.14)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2.5)(64bit)libc.so.6(GLIBC_2.3)(64bit)libc.so.6(GLIBC_2.3.2)(64bit)libc.so.6(GLIBC_2.3.4)(64bit)libc.so.6(GLIBC_2.32)(64bit)libc.so.6(GLIBC_2.33)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libc.so.6(GLIBC_2.4)(64bit)libc.so.6(GLIBC_2.8)(64bit)libcli-cldap-samba4.so()(64bit)libcli-cldap-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcli-ldap-common-samba4.so()(64bit)libcli-ldap-common-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcli-ldap-samba4.so()(64bit)libcli-ldap-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcli-nbt-samba4.so()(64bit)libcli-nbt-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcli-smb-common-samba4.so()(64bit)libcli-smb-common-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcliauth-samba4.so()(64bit)libcliauth-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcluster-samba4.so()(64bit)libcluster-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcmdline-contexts-samba4.so()(64bit)libcmdline-contexts-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcmdline-samba4.so()(64bit)libcmdline-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libcom_err.so.2()(64bit)libcommon-auth-samba4.so()(64bit)libcommon-auth-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libdbwrap-samba4.so()(64bit)libdbwrap-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libdcerpc-binding.so.0()(64bit)libdcerpc-binding.so.0(DCERPC_BINDING_0.0.1)(64bit)libdcerpc-samba-samba4.so()(64bit)libdcerpc-samba-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libdcerpc-samba4.so()(64bit)libdcerpc-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libdcerpc-server-core.so.0()(64bit)libdcerpc-server-core.so.0(DCERPC_SERVER_CORE_0.0.1)(64bit)libdcerpc.so.0()(64bit)libdcerpc.so.0(DCERPC_0.0.1)(64bit)libdsdb-module-samba4.so()(64bit)libdsdb-module-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libevents-samba4.so()(64bit)libevents-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libflag-mapping-samba4.so()(64bit)libflag-mapping-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libgenrand-samba4.so()(64bit)libgenrand-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libgensec-samba4.so()(64bit)libgensec-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libgnutls.so.30()(64bit)libgnutls.so.30(GNUTLS_3_4)(64bit)libgnutls.so.30(GNUTLS_3_6_13)(64bit)libgnutls.so.30(GNUTLS_3_6_3)(64bit)libgse-samba4.so()(64bit)libgse-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libidmap-samba4.so()(64bit)libidmap-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libk5crypto.so.3()(64bit)libk5crypto.so.3(k5crypto_3_MIT)(64bit)libkrb5.so.3()(64bit)libkrb5.so.3(krb5_3_MIT)(64bit)libkrb5samba-samba4.so()(64bit)libkrb5samba-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libldb.so.2()(64bit)libldb.so.2(LDB_0.9.10)(64bit)libldb.so.2(LDB_0.9.15)(64bit)libldb.so.2(LDB_0.9.16)(64bit)libldb.so.2(LDB_1.1.14)(64bit)libldb.so.2(LDB_2.0.1)(64bit)libldb.so.2(LDB_2.8.0)(64bit)libldbsamba-samba4.so()(64bit)libldbsamba-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)liblibcli-lsa3-samba4.so()(64bit)liblibcli-lsa3-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)liblibcli-netlogon3-samba4.so()(64bit)liblibcli-netlogon3-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)liblibsmb-samba4.so()(64bit)liblibsmb-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libmsrpc3-samba4.so()(64bit)libmsrpc3-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libndr-krb5pac.so.0()(64bit)libndr-krb5pac.so.0(NDR_KRB5PAC_0.0.1)(64bit)libndr-nbt.so.0()(64bit)libndr-nbt.so.0(NDR_NBT_0.0.1)(64bit)libndr-samba-samba4.so()(64bit)libndr-samba-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libndr-samba4.so()(64bit)libndr-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libndr-standard.so.0()(64bit)libndr-standard.so.0(NDR_STANDARD_0.0.1)(64bit)libndr.so.3()(64bit)libndr.so.3(NDR_0.0.1)(64bit)libndr.so.3(NDR_0.0.3)(64bit)libndr.so.3(NDR_0.0.4)(64bit)libndr.so.3(NDR_0.0.8)(64bit)libndr.so.3(NDR_0.0.9)(64bit)libndr.so.3(NDR_0.2.0)(64bit)libndr.so.3(NDR_1.0.0)(64bit)libnetapi.so.1()(64bit)libnetapi.so.1(NETAPI_1.0.0)(64bit)libnetif-samba4.so()(64bit)libnetif-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libnss-info-samba4.so()(64bit)libnss-info-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libpopt.so.0()(64bit)libpopt.so.0(LIBPOPT_0)(64bit)libprinter-driver-samba4.so()(64bit)libprinter-driver-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libreadline.so.7()(64bit)libregistry-samba4.so()(64bit)libregistry-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libreplace-samba4.so()(64bit)libreplace-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamba-credentials.so.1()(64bit)libsamba-credentials.so.1(SAMBA_CREDENTIALS_1.0.0)(64bit)libsamba-debug-samba4.so()(64bit)libsamba-debug-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamba-errors.so.1()(64bit)libsamba-errors.so.1(SAMBA_ERRORS_1.0.0)(64bit)libsamba-hostconfig.so.0()(64bit)libsamba-hostconfig.so.0(SAMBA_HOSTCONFIG_0.0.1)(64bit)libsamba-modules-samba4.so()(64bit)libsamba-modules-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamba-net.cpython-36m-x86-64-linux-gnu-samba4.so()(64bit)libsamba-net.cpython-36m-x86-64-linux-gnu-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamba-passdb.so.0()(64bit)libsamba-passdb.so.0(SAMBA_PASSDB_0.2.0)(64bit)libsamba-security-samba4.so()(64bit)libsamba-security-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamba-sockets-samba4.so()(64bit)libsamba-sockets-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamba-util.so.0()(64bit)libsamba-util.so.0(SAMBA_UTIL_0.0.1)(64bit)libsamba3-util-samba4.so()(64bit)libsamba3-util-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamdb-common-samba4.so()(64bit)libsamdb-common-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsamdb.so.0()(64bit)libsamdb.so.0(SAMDB_0.0.1)(64bit)libsecrets3-samba4.so()(64bit)libsecrets3-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libserver-id-db-samba4.so()(64bit)libserver-id-db-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libshares-samba4.so()(64bit)libshares-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsmbclient-raw-samba4.so()(64bit)libsmbclient-raw-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsmbclient.so.0()(64bit)libsmbclient.so.0(SMBCLIENT_0.1.0)(64bit)libsmbclient.so.0(SMBCLIENT_0.3.1)(64bit)libsmbclient.so.0(SMBCLIENT_0.3.2)(64bit)libsmbclient.so.0(SMBCLIENT_0.3.3)(64bit)libsmbclient.so.0(SMBCLIENT_0.5.0)(64bit)libsmbclient.so.0(SMBCLIENT_0.6.0)(64bit)libsmbconf.so.0()(64bit)libsmbconf.so.0(SMBCONF_0.0.1)(64bit)libsmbd-shim-samba4.so()(64bit)libsmbd-shim-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsmbpasswdparser-samba4.so()(64bit)libsmbpasswdparser-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsocket-blocking-samba4.so()(64bit)libsocket-blocking-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libsys-rw-samba4.so()(64bit)libsys-rw-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libtalloc.so.2()(64bit)libtalloc.so.2(TALLOC_2.0.2)(64bit)libtalloc.so.2(TALLOC_2.0.8)(64bit)libtalloc.so.2(TALLOC_2.1.0)(64bit)libtalloc.so.2(TALLOC_2.3.5)(64bit)libtdb-wrap-samba4.so()(64bit)libtdb-wrap-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libtdb.so.1()(64bit)libtdb.so.1(TDB_1.2.1)(64bit)libtevent-util.so.0()(64bit)libtevent-util.so.0(TEVENT_UTIL_0.0.1)(64bit)libtevent.so.0()(64bit)libtevent.so.0(TEVENT_0.11.0)(64bit)libtevent.so.0(TEVENT_0.12.0)(64bit)libtevent.so.0(TEVENT_0.13.0)(64bit)libtevent.so.0(TEVENT_0.15.0)(64bit)libtevent.so.0(TEVENT_0.9.12)(64bit)libtevent.so.0(TEVENT_0.9.13)(64bit)libtevent.so.0(TEVENT_0.9.16)(64bit)libtevent.so.0(TEVENT_0.9.20)(64bit)libtevent.so.0(TEVENT_0.9.26)(64bit)libtevent.so.0(TEVENT_0.9.30)(64bit)libtevent.so.0(TEVENT_0.9.31)(64bit)libtevent.so.0(TEVENT_0.9.36)(64bit)libtevent.so.0(TEVENT_0.9.37)(64bit)libtevent.so.0(TEVENT_0.9.9)(64bit)libtime-basic-samba4.so()(64bit)libtime-basic-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libtorture-samba4.so()(64bit)libtorture-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libtrusts-util-samba4.so()(64bit)libtrusts-util-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libutil-reg-samba4.so()(64bit)libutil-reg-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libutil-tdb-samba4.so()(64bit)libutil-tdb-samba4.so(SAMBA_4.19.9_GIT.435.78CED6CF30D150600.3.21.1SUSE_OS15.0_X86_64_SAMBA4)(64bit)libwbclient.so.0()(64bit)libwbclient.so.0(WBCLIENT_0.10)(64bit)libwbclient.so.0(WBCLIENT_0.9)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)sambasamba-winbind3.0.4-14.6.0-14.0-15.2-14.19.8+git.435.78ced6cf30d4.19.8+git.435.78ced6cf30d4.14.3hҋhm@g`@gRgR@gMgp@fٝ@fxfteԔ@ee5@ede6`@e-%e'e%anopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comddiss@suse.comscabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedimstar@opensuse.orgscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.descabrero@suse.denopower@suse.comscabrero@suse.deddiss@suse.comddiss@suse.comddiss@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comnopower@suse.comscabrero@suse.descabrero@suse.dedmulder@suse.comscabrero@suse.descabrero@suse.denopower@suse.comnopower@suse.comnopower@suse.comdmulder@suse.comscabrero@suse.denopower@suse.comddiss@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comjmcdonough@suse.comnopower@suse.comscabrero@suse.denopower@suse.comnopower@suse.comddiss@suse.comddiss@suse.comnopower@suse.comnopower@suse.comddiss@suse.comnopower@suse.comdmulder@suse.comdmulder@suse.comddiss@suse.comscabrero@suse.dedmulder@suse.comddiss@suse.comnopower@suse.comjengelh@inai.dedmulder@suse.comscabrero@suse.descabrero@suse.descabrero@suse.dedmulder@suse.comdmulder@suse.comdmulder@suse.comjmcdonough@suse.comdmulder@suse.comscabrero@suse.dedmulder@suse.comscabrero@suse.dedmulder@suse.comdmulder@suse.comvcizek@suse.comdmulder@suse.comdmulder@suse.comnopower@suse.comscabrero@suse.dejmcdonough@suse.comscabrero@suse.deaaptel@suse.comjengelh@inai.dedimstar@opensuse.orgdmulder@suse.comjmcdonough@suse.comdavid.mulder@suse.comjmcdonough@suse.comaaptel@suse.comdmulder@suse.comscabrero@suse.comscabrero@suse.comkukuk@suse.dedavid.mulder@suse.comscabrero@suse.comrbrown@suse.comdmulder@suse.comscabrero@suse.comdimstar@opensuse.orgscabrero@suse.comaaptel@suse.comnopower@suse.comnopower@suse.comaaptel@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comddiss@suse.comnopower@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comddiss@suse.comdmulder@suse.comnopower@suse.comjmcdonough@suse.comaaptel@suse.comkukuk@suse.comkukuk@suse.denopower@suse.comaaptel@suse.comdmulder@suse.comddiss@suse.comdmulder@suse.comddiss@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comnopower@suse.comnopower@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comnopower@suse.comddiss@suse.comjmcdonough@suse.comddiss@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comjmcdonough@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comtchvatal@suse.comlmuelle@suse.comnopower@suse.comcrrodriguez@opensuse.orglmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.comnoel.power@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comnopower@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.comlmuelle@suse.comddiss@suse.comlmuelle@suse.commpluskal@suse.comlmuelle@suse.comnopower@suse.deddiss@suse.comddiss@suse.comddiss@suse.comlmuelle@suse.denopower@suse.delmuelle@suse.comnopower@suse.deddiss@suse.comlmuelle@suse.comlmuelle@suse.comlmuelle@suse.com- CVE-2025-9640: fix vfs_streams_xattr uninitialized memory write; (bsc#1251279);(bso#15885). - CVE-2025-10230: fix command Injection in WINS Server Hook Script; (bsc#1251280);(bso#15903).- Windows security hardening locks out schannel'ed netlogon dc calls like netr_DsRGetDCName; (bsc#1246431); (bso#15876).- Fix Samba printers reporting invalid sid during print jobs; (bsc#1234210); (bso#15792).- Fix crossing automounter mount points; (bsc#1215212); (bsc#1236803);- Update shipped /etc/samba/smb.conf to point to smb.conf man page;(bsc#1233880).- Update to 4.19.9 * libldb: performance issue with indexes (ldb 2.8.2 is already released); (bso#15590). * DH reconnect error handling can lead to stale sharemode entries; (bso#15624). * Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699). * irpc_destructor may crash during shutdown; (bso#15280). * Compound SMB2 requests don't return NT_STATUS_NETWORK_SESSION_EXPIRED for all requests, confuses MacOSX clients; (bso#15696). * Crash when readlinkat fails; (bso#15700).- Adjust spec to split out rpcd_* binaries into a separate sub package; (bsc#1231414).- Incorrect FSCTL_QUERY_ALLOCATED_RANGES response when truncated; (bso#15699); (bsc#1229684). - Update to 4.19.8 * Invalid client warning about command line passwords; (bso#15671); * Version string is truncated in manpages; (bso#15672); * --version-* options are still not ergonomic, and they reject tilde characters; (bso#15673); * cmdline_burn does not always burn secrets; (bso#15674); * Samba doesn't parse SDDL found in defaultSecurityDescriptor in AD_DS_Classes_Windows_Server_v1903.ldf; (bso#15685); * We have added new options --vendor-name and --vendor-patch- revision arguments to ./configure to allow distributions and packagers to put their name in the Samba version string so that when debugging Samba the source of the binary is obvious; (bso#15654); * When claims enabled with heimdal kerberos, unable to log on to a Windows computer when user account need to change their own password; (bso#15655); * Fix clock skew error message and memory cache clock skew recovery; (bso#15676); * CTDB RADOS mutex helper misses namespace support; (bso#15665); * The images don't build after the git security release and CentOS 8 Stream is EOL; (bso#15660); * Fix unnecessary delays in CTDB while processing requests under high load; (bso#15678); * Dynamic DNS updates with the internal DNS are not working; (bso#13019); * s4:nbt_server: does not provide unexpected handling, so winbindd can't use nmb requests instead cldap; (bso#15620); * Panic in vfs_offload_token_db_fetch_fsp(); (bso#15664); * "client use kerberos" and --use-kerberos is ignored for the machine account; (bso#15666); * Regression DFS not working with widelinks = true; (bso#15435); * ntlm_auth make logs more consistent with length check; (bso#15677);- Fix a crash when joining offline and 'kerberos method' includes keytab; (bsc#1228732); - Fix reading the password from STDIN or environment vars if it was already given in the command line; (bsc#1228732);- Update to 4.19.7 * ldb qsort might r/w out of bounds with an intransitive compare function (ldb 2.8.1 is already released); (bso#15569). * Many qsort() comparison functions are non-transitive, which can lead to out-of-bounds access in some circumstances (ldb 2.8.1 is already released); (bso#15625). * Need to change gitlab-ci.yml tags in all branches to avoid CI bill; (bso#15638). * netr_LogonSamLogonEx returns NR_STATUS_ACCESS_DENIED with SysvolReady=0; (bso#14981). * Anonymous smb3 signing/encryption should be allowed (similar to Windows Server 2022); (bso#15412). * Panic in dreplsrv_op_pull_source_apply_changes_trigger; (bso#15573). * winbindd, net ads join and other things don't work on an ipv6 only host; (bso#15642). * Smbcacls incorrectly propagates inheritance with Inherit-Only flag; (bso#15636). * http library doesn't support 'chunked transfer encoding'; (bso#15611). - Update to 4.19.6 * fd_handle_destructor() panics within an smbd_smb2_close() if vfs_stat_fsp() fails in fd_close(); (bso#15527). * samba-gpupdate: Correctly implement site support; (bso#15588). * libgpo: Segfault in python bindings; (bso#15599). * Packet marshalling push support missing for CTDB_CONTROL_TCP_CLIENT_DISCONNECTED and CTDB_CONTROL_TCP_CLIENT_PASSED; (bso#15580).- Update to 4.19.5 * Windows 2016 fails to restore previous version of a file from a shadow_copy2 snapshot; (bso#13688). * Symlinks on AIX are broken in 4.19 (and a few version before that); (bso#15549). * Fake directory create times has no effect; (bso#12421). * ctime mixed up with mtime by smbd; (bso#15550). * samba-gpupdate --rsop fails if machine is not in a site; (bso#15548). * gpupdate: The root cert import when NDES is not available is broken; (bso#15557). * samba-gpupdate should print a useful message if cepces-submit can't be found; (bso#15552). * samba-gpupdate logging doesn't work; (bso#15558). * smbpasswd reset permissions only if not 0600; (bso#15555).- Remove -x from bash shebang update-apparmor-samba-profile; (bsc#1218431).- Update to 4.19.4 * net changesecretpw cannot set the machine account password if secrets.tdb is empty; (bso#13577). * For generating doc, take, if defined, env XML_CATALOG_FILES; (bso#15540). * Trivial C typo in nsswitch/winbind_nss_netbsd.c; (bso#15541). * vfs_linux_xfs is incorrectly named; (bso#15542). * systemd stumbled over copyright-message at smbd startup; (bso#15377). * Following intermediate abolute share-local symlinks is broken; (bso#15505). * ctdb RELEASE_IP causes a crash in release_ip if a connection to a non-public address disconnects first; (bso#15523). * shadow_copy2 broken when current fileset's directories are removed; (bso#15544). * smbd does not detect ctdb public ipv6 addresses for multichannel exclusion; (bso#15534). * 'force user = localunixuser' doesn't work if 'allow trusted domains = no' is set; (bso#15469). * smbget debug logging doesn't work; (bso#15525). * smget: username in the smburl and interactive password entry doesn't work; (bso#15532). * smbget auth function doesn't set values for password prompt correctly; (bso#15538). * Unable to copy and write files from clients to Ceph cluster via SMB Linux gateway with Ceph VFS module; (bso#15440). * Multichannel refresh network information; (bso#15547).- Update to 4.19.3 * sid_strings test broken by unix epoch > 1700000000; (bso#15520). * smbd crashes if asked to return full information on close of a stream handle with delete on close disposition set; (bso#15487). * smbd: fix close order of base_fsp and stream_fsp in smb_fname_fsp_destructor(); (bso#15521). * Improve logging for failover scenarios; (bso#15499). * Files without "read attributes" NFS4 ACL permission are not listed in directories; (bso#15093). * CVE-2018-14628 [SECURITY] Deleted Object tombstones visible in AD LDAP to normal users; (bso#13595). * Kerberos TGS-REQ with User2User does not work for normal accounts; (bso#15492). * vfs_gpfs stat calls fail due to file system permissions; (bso#15507). * Samba doesn't build with Python 3.12; (bso#15513).- packaging: samba-tool domain provision requires python3-Markdown; (bsc#1216519).- Update to 4.19.2 * Use-after-free in aio_del_req_from_fsp during smbd shutdown after failed IPC FSCTL_PIPE_TRANSCEIVE; (bso#15423). * clidfs.c do_connect() missing a "return" after a cli_shutdown() call; (bso#15426). * macOS mdfind returns only 50 results; (bso#15463). * GETREALFILENAME_CACHE can modify incoming new filename with previous cache entry value; (bso#15481). * libnss_winbind causes memory corruption since samba-4.18, impacts sendmail, zabbix, potentially more; (bso#15464). * ctdbd: setproctitle not initialized messages flooding logs; (bso#15479). * CVE-2023-5568 Heap buffer overflow with freshness tokens in the Heimdal KDC in Samba 4.19; (bso#15491). * The heimdal KDC doesn't detect s4u2self correctly when fast is in use; (bso#15477).- use systemd-logind rather than utmp for y2038 safety; (bsc#1216159).- CVE-2023-4091: samba: Client can truncate file with read-only permissions; (bsc#1215904); (bso#15439). - CVE-2023-42669: samba: rpcecho, enabled and running in AD DC, allows blocking sleep on request; (bso#1215905); (bso#15474). - CVE-2023-42670: samba: The procedure number is out of range when starting Active Directory Users and Computers; (bsc#1215906); (bso#15473). - CVE-2023-3961: samba: Unsanitized client pipe name passed to local_np_connect(); (bsc#1215907); (bso#15422). - CVE-2023-4154: samba: dirsync allows SYSTEM access with only "GUID_DRS_GET_CHANGES" right, not "GUID_DRS_GET_ALL_CHANGES; (bsc#1215908); (bso#15424).- Update to 4.19.0 * File doesn't show when user doesn't have permission if aio_pthread is loaded; (bso#15453). * ctdb_killtcp fails to work with --enable-pcap and libpcap ≥ 1.9.1; (bso#15451). * Logging to stdout/stderr with DEBUG_SYSLOG_FORMAT_ALWAYS can log to syslog; (bso#15460). * ‘samba-tool domain level raise’ fails unless given a URL; (bso#15458). * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420). * missing return in reply_exit_done(); (bso#15430). * TREE_CONNECT without SETUP causes smbd to use uninitialized pointer; (bso#15432). * Avoid infinite loop in initial user sync with Azure AD Connect when synchronising a large Samba AD domain; (bso#15401). * Samba replication logs show (null) DN; (bso#15407). * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346). * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446). * CID 1539212 causes real issue when output contains only newlines; (bso#15438). * KDC encodes INT64 claims incorrectly; (bso#15452). * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449). * Windows client join fails if a second container CN=System exists somewhere; (bso#9959). * regression DFS not working with widelinks = true; (bso#15435). * Heimdal fails to build on 32-bit FreeBSD; (bso#15443). * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441). - Update to 4.18.6 * reply_sesssetup_and_X() can dereference uninitialized tmp pointer; (bso#15420); * Missing return in reply_exit_done(); (bso#15430); * post-exec password redaction for samba-tool is more reliable for fully random passwords as it no longer uses regular expressions containing the password value itself; (bso#15289); * Windows client join fails if a second container CN=System exists somewhere; (bso#9959); * Spotlight sometimes returns no results on latest macOS; (bso#15342); * Renaming results in NT_STATUS_SHARING_VIOLATION if previously attempted to remove the destination; (bso#15417); * Spotlight results return wrong date in result list; (bso#15427); * "net offlinejoin provision" does not work as non-root user; (bso#15414); * rpcserver no longer accepts double backslash in dfs pathname; (bso#15400); * cm_prepare_connection() calls close(fd) for the second time; (bso#15433); * 2-3min delays at reconnect with smb2_validate_sequence_number: bad message_id 2; (bso#15346); * samba-tool ntacl get segfault if aio_pthread appended; (bso#15441); * DCERPC_PKT_CO_CANCEL and DCERPC_PKT_ORPHANED can't be parsed; (bso#15446); * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation); (bso#15390); * Regression DFS not working with widelinks = true; (bso#15435); * mdssvc: Do an early talloc_free() in _mdssvc_open(); (bso#15449); - Update to 4.18.5 * CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). * CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). * CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). * CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). * CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170). * secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384). - Update to 4.18.4 * Backport --pidl-developer fixes; (bso#15404). * Named crashes on DLZ zone update; (bso#14030). * smbcacls and smbcquotas do not check // before the server; (bso#2312). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * smbd returns NOT_FOUND when creating files on a r/o filesystem; (bso#15402). * NSS_WRAPPER_HOSTNAME doesn't match NSS_WRAPPER_HOSTS entry and causes test timeouts; (bso#15355). * net ads lookup (with unspecified realm) fails; (bso#15384). * Register Samba processes with GPFS; (bso#15381). * Python tarfile extraction needs change to avoid a warning (CVE-2007-4559 mitigation); (bso#15390). * The winbind child segfaults when listing users with `winbind scan trusted domains = yes`; (bso#15398). * Remove comments about deprecated 'write cache size'; (bso#15383). * smbget memory leak if failed to download files recursively; (bso#15403). - Update to 4.18.3 * Symlinks to files can have random DOS mode information in a directory listing; (bso#15375). * vfs_fruit might cause a failing open for delete; (bso#15378). * winbind recurses into itself via rpcd_lsad; (bso#15361). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * a lot of messages: get_static_share_mode_data: get_static_share_mode_data_fn failed: NT_STATUS_NOT_FOUND; (bso#15362). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * Setting veto files = /.*/ break listing directories; (bso#15360). * "samba-tool domain provision" does not run interactive mode if no arguments are given; (bso#15363). * dsgetdcname: assumes local system uses IPv4; (bso#15325). - Update to 4.18.2 * Log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * Flapping tests in samba_tool_drs_show_repl.py; (bso#15316). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Tests use depricated and removed methods like assertRegexpMatches; (bso#15343). - Update to 4.18.1 * CVE-2023-0225: AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users. (bso#15276);(bsc#1209483). * CVE-2023-0614: Access controlled AD LDAP attributes can be discovered (bso#15270); (bsc#1209485). * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext(bso#15315);(bsc#1209481). * ldb wildcard matching makes excessive allocations; (bso#15331). * large_ldap test is inefficient; (bso#15332). - Update to 4.18.0 * SMB server performance improvements * More succinct samba-tool error messages * Color output with samba-tool --color The NO_COLOR environment variable will disable colour output * New samba-tool dsacl subcommand for deleting ACEs * New wbinfo option --change-secret-at * Net option to change the NT ACL default location * Azure AD / Office365 synchronization improvements- Fix DFS not working with widelinks enabled; (bsc#1213607); (bso#15435);- Move libcluster-samba4.so from samba-libs to samba-client-libs; (bsc#1213940);- net ads lookup with unspecified realm fails; (bso#15384); (bsc#1213826);- secure channel faulty since Windows 10/11 update 07/2023; (bso#15418); (bsc#1213384).- CVE-2022-2127: lm_resp_len not checked properly in winbindd_pam_auth_crap_send; (bso#15072); (bsc#1213174). - CVE-2023-34966: Samba Spotlight mdssvc RPC Request Infinite Loop Denial-of-Service Vulnerability; (bso#15340); (bsc#1213173). - CVE-2023-34967: Samba Spotlight mdssvc RPC Request Type Confusion Denial-of-Service Vulnerability; (bso#15341); (bsc#1213172). - CVE-2023-34968: Spotlight server-side Share Path Disclosure; (bso#15388); (bsc#1213171). - CVE-2023-3347: Samba doesn't require SMB2+ signing if `server signing = mandatory` is set; (bso#15397); (bsc#1213170).- Update to 4.17.9 * Backport --pidl-developer fixes; (bso#15404). * smbd_scavenger crashes when service smbd is stopped; (bso#15275). * vfs_fruit might cause a failing open for delete; (bso#15378). * named crashes on DLZ zone update; (bso#14030). * winbind recurses into itself via rpcd_lsad; (bso#15361). * cli_list loops 100% CPU against pre-lanman2 servers; (bso#15382). * smbclient leaks fds with showacls; (bso#15391). * aes256 smb3 encryption algorithms are not allowed in smb3_sid_parse(); (bso#15374). * winbindd gets stuck on NT_STATUS_RPC_SEC_PKG_ERROR; (bso#15413). * smbget memory leak if failed to download files recursively; (bso#15403).- Update to 4.17.8 * log flood: smbd_calculate_access_mask_fsp: Access denied: message level should be lower; (bso#15302). * Floating point exception (FPE) via cli_pull_send at source3/libsmb/clireadwrite.c; (bso#15306). * test_tstream_more_tcp_user_timeout_spin fails intermittently on Rackspace GitLab runners; (bso#15328). * Reduce flapping of ridalloc test; (bso#15329). * large_ldap test is unreliable; (bso#15351). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * mdssvc may crash when initializing; (bso#15354). * Large directory optimization broken for non-lcomp path elements; (bso#15313). * streams_depot fails to create streams; (bso#15357). * shadow_copy2 and streams_depot don't play well together; (bso#15358). * wbinfo -u fails on ad dc with >1000 users; (bso#15366). * winbindd idmap child contacts the domain controller without a need; (bso#15317). * idmap_autorid may fail to map sids of trusted domains for the first time; (bso#15318). * idmap_hash doesn't use ID_TYPE_BOTH for reverse mappings; (bso#15319). * net ads search -P doesn't work against servers in other domains; (bso#15323). * DS ACEs might be inherited to unrelated object classes; (bso#15338). * Temporary smbXsrv_tcon_global.tdb can't be parsed; (bso#15353). * Setting veto files = /.*/ break listing directories; (bso#15360); (bsc#1212375). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). * dsgetdcname: assumes local system uses IPv4; (bso#15325).- Update to 4.17.7 * CVE-2023-0922: Samba AD DC admin tool samba-tool sends passwords in cleartext; (bso#15315); (bsc#1209481). * CVE-2023-0225: Samba AD DC "dnsHostname" attribute can be deleted by unprivileged authenticated users; (bso#15276); (bsc#1209483). * CVE-2023-0614: samba: Access controlled AD LDAP attributes can be discovered; (bso#15270); (bsc#1209485). * large_ldap test is inefficient; (bso#15332). * CVE-2020-25720 [SECURITY] Create Child permission should not allow full write to all attributes (additional changes); (bso#14810). - Update to 4.17.6 * streams_xattr is creating unexpected locks on folders; (bso#15314). * Use of the Azure AD Connect cloud sync tool is now supported for password hash synchronisation, allowing Samba AD Domains to synchronise passwords with this popular cloud environment; (bso#10635). * Spotlight doesn't work with latest macOS Ventura; (bso#15299). * New samba-dcerpc architecture does not scale gracefully; (bso#15310). * vfs_ceph incorrectly uses fsp_get_io_fd() instead of fsp_get_pathref_fd() in close and fstat; (bso#15307). * With clustering enabled samba-bgqd can core dump due to use after free; (bso#15293). * fd_load() function implicitly closes the fd where it should not; (bso#15311). - Update to 4.17.5 * smbc_getxattr() return value is incorrect; (bso#14808). * Compound SMB2 FLUSH+CLOSE requests from MacOSX are not handled correctly; (bso#15172). * synthetic_pathref AFP_AfpInfo failed errors; (bso#15210). * samba-tool gpo listall fails IPv6 only - finddcs() fails to find DC when there is only an AAAA record for the DC in DNS; (bso#15226). * smbd crashes if an FSCTL request is done on a stream handle; (bso#15236). * DFS links don't work anymore on Mac clients since 4.17; (bso#15277). * vfs_virusfilter segfault on access, directory edgecase (accessing NULL value); (bso#15283). * CVE-2022-38023 [SECURITY] Samba should refuse RC4 (aka md5) based SChannel on NETLOGON (additional changes); (bso#15240). * %U for include directive doesn't work for share listing (netshareenum); (bso#15243). * Shares missing from netshareenum response in samba 4.17.4; (bso#15266). * ctdb: use-after-free in run_proc; (bso#15269). * irpc_destructor may crash during shutdown; (bso#15280). * auth3_generate_session_info_pac leaks wbcAuthUserInfo; (bso#15286). * smbclient segfaults with use after free on an optimized build; (bso#15268). * smbstatus leaking files in msg.sock and msg.lock; (bso#15282). * Leak in wbcCtxPingDc2; (bso#15164). * Access based share enum does not work in Samba 4.16+; (bso#15265). * Crash during share enumeration; (bso#15267). * rep_listxattr on FreeBSD does not properly check for reads off end of returned buffer; (bso#15271). * Avoid relying on C89 features in a few places; (bso#15281).- Make (32bit) samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck.- Make samba-libs conflict with old samba-ad-dc-libs package to satisfy installcheck.- Remove non functioning ifup/ifdown samba-winbindd scripts; (bsc#1207414).- libdsdb-module-samba4 should be packaged as part of samba-libs and not samba-ad-dc-libs. Additionally no need for it to be removed conditionally.- Clean up logic for PAM migration settings in spec file.- Change with_dc default to 0 (for non TW builds), ADDC feature is deprecated and will no longer be included in >= SLE15-SP5; (jsc#PED-1122).- Update to 4.17.4 * CVE-2022-44640 Upstream Heimdal free of user-controlled pointer in FAST; (bsc#14929); * CVE-2021-20251 Bad password count not incremented atomically; (bsc#14611); * CVE-2022-42898 krb5_pac_parse() buffer parsing vulnerability; (bsc#15203); * CVE-2022-37966 rc4-hmac Kerberos session keys issued to modern servers; (bso#15237); * CVE-2022-37967 Kerberos constrained delegation ticket forgery possible against Samba AD DC; (bso#15231); * CVE-2022-38023 RC4/HMAC-MD5 NetLogon Secure Channel is weak and should be avoided; (bso#15240); * pam_winbind uses time_t and pointers assuming they are of the same size; (bso#15224); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * filter-subunit is inefficient with large numbers of knownfails; (bso#15258); * smbd allows setting FILE_ATTRIBUTE_TEMPORARY on directories; (bso#15252); * The KDC logic arround msDs-supportedEncryptionTypes differs from Windows; (bso#13135); * libnet: change_password() doesn't work with dcerpc_samr_ChangePasswordUser4(); (bso#15206); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); * Memory leak in snprintf replacement functions; (bso#15230); * RODC doesn't reset badPwdCount reliable via an RWDC (CVE-2021-20251 regression); (bso#15253); * Prevent EBADF errors with vfs_glusterfs; (bso#15198); * %U for include directive doesn't work for share listing (netshareenum); (bso#15243); * Stack smashing in net offlinejoin requestodj; (bso#15257); * Windows 11 22H2 and Samba-AD 4.15 Kerberos login issue; (bso#15197); * Heimdal session key selection in AS-REQ examines wrong entry; (bso#15219); - Remove deprecated if-{down,up} scripts; (bsc#1206444); - Adjust the systemd drop-in file for named service; (bsc#1201689); * Paths are additive so do not repeat paths from named.service * Prefix the samba DLZ directory with "-" to ignore this path if it does not exists- Introduce without-smb1-server spec flag; (bsc#1205104); - Update to 4.17.3 * CVE-2022-42898: Samba buffer overflow vulnerabilities on 32-bit systems; (bsc#1205126); (bso#15203); - Replace obsolete python-gpgme with python-gpg * Upstream replaced it in v4.9.5 -- bso#13728 - Update to 4.17.2 * CVE-2022-3592 [SECURITY] samba: Wide links protection broken; (bso#15207); (bsc#1204499). * CVE-2022-3437 [SECURITY] samba: Buffer overflow in Heimdal unwrap_des3();(bso#15134); (bsc#1204254). - Update to 4.17.1 * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Flush on a named stream never completes; (bso#15182). * Permission denied calling SMBC_getatr when file not exists; (bso#15195). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * pytest: add file removal helpers for TestCaseInTempDir; (bso#15191). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * Samba 4.5 sometimes cannot be upgraded to Samba 4.6 or later over DRS: WERROR_DS_DRA_MISSING_PARENT due to faulty GET_ANC; (bso#15189). * Flush on a named stream never completes; (bso#15182). * vfs_gpfs silently garbles timestamps > year 2106; (bso#15151). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). * multi-channel socket passing may hit a race if one of the involved processes already existed; (bso#15200). * memory leak on temporary of struct imessaging_post_state and struct tevent_immediate on struct imessaging_context (in rpcd_spoolss and maybe others); (bso#15201). * Since popt1.19 various use after free errors using result of poptGetArg are now exposed; (bso#15205); (boo#1204279). * Remove special case for O_CREAT in SMB_VFS_OPENAT from vfs_glusterfs; (bso#15192). * GETPWSID in memory cache grows indefinetly with each NTLM auth; (bso#15169). * CVE-2021-20251 [SECURITY] Bad password count not incremented atomically; (bso#14611). - Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689); - Fix use after free errors resulting from using return of poptGetArg exposed since popt-1.19; (boo#1204279); (bso#15205). - s3: smbd: Fix memory leak in smbd_server_connection_terminate_done(); (bso#15174). - Disable SMB1 for tumbleweed builds. - Update to 4.17.0 * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Cross-node multi-channel reconnects result in SMB2 Negotiate returning NT_STATUS_NOT_SUPPORTED; (bso#15159). * winbind at info level debug can coredump when processing wb_lookupusergroups; (bso#15160). * Make use of glfs_*at() API calls in vfs_glusterfs; (bso#15157). * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128). * `net usershare add` fails with flag works with --long but fails with -l; (bso#15145). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Performance regression on contended path based operations; (bso#15125). * Missing READ_LEASE break could cause data corruption; (bso#15148). * libsamba-errors uses a wrong version number; (bso#15141). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * New filename parser doesn't check veto files smb.conf parameter; (bso#15143). * 4.17.rc1 still uses symlink-race prone unix_convert(); (bso#15144). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Manpage for smbstatus json is missing; (bso#15147). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Performance regression on contended path based operations; (bso#15125). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). * Fix issues found by coverity in smbstatus json code; (bso#15140). * Backport fileserver related changed to 4.17.0rc2; (bso#15146). - Migration to /usr/etc: Saving user changed configuration files in /etc and restoring them while an RPM update. - Update to 4.16.4 * CVE-2022-2031: Samba AD users can bypass certain restrictions associated with changing passwords; (bsc#1201495); (bso#15047); * CVE-2022-32744: Samba AD users can forge password change requests for any user; (bsc#1201493); (bso#15074); * CVE-2022-32745: Samba AD users can crash the server process with an LDAP add or modify request; (bsc#1201492); (bso#15008); * CVE-2022-32746: Samba AD users can induce a use-after-free in the server process with an LDAP add or modify request; (bsc#1201490); (bso#15009); * CVE-2022-32742: Server memory information leak via SMB1; (bsc#1201496); (bso#15085); - Update to 4.16.3 * Using vfs_streams_xattr and deleting a file causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * Samba with new lorikeet-heimdal fails to build on gcc 12.1 in developer mode; (bso#15095); * Crash in streams_xattr because fsp->base_fsp->fsp_name is NULL; (bso#15105); * Crash in rpcd_classic - NULL pointer deference in mangle_is_mangled(); (bso#15118); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * Fix check for chown when processing NFSv4 ACL; (bso#15120); * The pcap background queue process should not be stopped; (bso#15082); * testparm: Fix typo in idmap rangesize check; (bso#15097); * net ads info returns LDAP server and LDAP server name as null; (bso#15106); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * CTDB child process logging does not work as expected; (bso#15090); - Update spec file to fix the optional Heimdal DC build - Fix external trusts with MIT Kerberos 1.20 - Add missing samba-client requirement to samba-winbind package; (bsc#1198255); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Add sysuser-shadow requirement for packages using systemd-sysusers - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979); - Moved logrotate files from user specific directory /etc/logrotate.d to vendor specific directory /usr/etc/logrotate.d. - Update to 4.16.2 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * Reintroduce netgroups support; (bso#15087); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Update from 4.15 to 4.16 breaks discovery of [homes] on standalone server from Win and IOS; (bso#15062); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient -E doesn't work as advertised; (bso#15075); * The samba background daemon doesn't refresh the printcap cache on startup; (bso#15081); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Fix samba4.blackbox.net_ads_dns_async test with bind9 >= 9.17.7 - Support building with MIT Kerberos 1.20 - Bronze bit and S4U support with MIT Kerberos 1.20 for Samba AD DC; (CVE-2020-17049); - Resource Based Constrained Delegation (RBCD) for Samba AD DC - Support building with gcc 12.1 - Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362); - Update to 4.16.1 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * Need to describe --builtin-libraries= better (compare with - -bundled-libraries); (bso#8731); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * Username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * KVNO off by 100000; (bso#14951); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * smbd doesn't handle UPNs for looking up names; (bso#15054); - Update update-apparmor-samba-profile script, replace non-printable delimiter with more human readable separator as sed can accept separators that can appear in the input data. - Fix update-apparmor-samba-profile script, sed doesn't like multibyte separators; (bsc#1198309). - Update to 4.16.0 * New samba-dcerpcd binary to provide DCERPC in the member server setup * Certificate Auto Enrollment * Ability to add ports to dns forwarder addresses in internal DNS backend * No longer using Linux mandatory locks for sharemodes * SMB1 protocol has been deprecated, particularly older dialects * SMB1 protocol SMBCopy command removed * SMB1 server-side wildcard expansion removed - Add python3-dnspython to samba-ad-dc recommens; (bsc#1187101); - Use systemd-sysusers to create system users; (bsc#1182847);- Install a systemd drop-in file for named service to allow read/write access to the DLZ directory; (bsc#1201689);- Update to 4.15.12 * CVE-2022-42898: samba: heimdal: Samba buffer overflow vulnerabilities on 32-bit systems; (bso#15203); (bsc#1205126). - Update to 4.15.11 * Allow rebuild of Centos 8 images after move to vault for Samba 4.15; (bso#15193). * CVE-2022-3437: samba: Buffer overflow in Heimdal unwrap_des3(); (bso#15134); (bsc#1204254)- Update to 4.15.10 * Possible use after free of connection_struct when iterating smbd_server_connection->connections; (bso#15128); (bsc#1200102). * smbXsrv_connection_shutdown_send result leaked; (bso#15174). * Spotlight RPC service returns wrong response when Spotlight is disabled on a share; (bso#15086). * acl_xattr VFS module may unintentionally use filesystem permissions instead of ACL from xattr; (bso#15126). * Missing SMB2-GETINFO access checks from MS-SMB2 3.3.5.20.1; (bso#15153). * assert failed: !is_named_stream(smb_fname)") at ../../lib/util/fault.c:197; (bso#15161). * Missing READ_LEASE break could cause data corruption; (bso#15148). * rpcclient can crash using setuserinfo(2); (bso#15124). * Samba fails to build with glibc 2.36 caused by including in libreplace; (bso#15132). * SMB1 negotiation can fail to handle connection errors; (bso#15152). * samba-tool domain join segfault when joining a samba ad domain; (bso#15078). - Update to 4.15.9 * CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). * CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). * CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); * CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- CVE-2022-1615: Do not ignore errors in random number generation; (bso#15103); (bsc#1202976); - CVE-2022-32743: Implement validated dnsHostName write rights; (bso#14833); (bsc#1202803);- Fix Use after free when iterating smbd_server_connection->connections after tree disconnect failure; (bso#15128); (bsc#1200102).- CVE-2022-32746: samba: Use-after-free occurring in database audit logging; (bso#15009); (bso#15096); (bsc#1201490). - CVE-2022-32745: samba: ldb: AD users can crash the server process with an LDAP add or modify request; (bso#15008); (bso#15096); (bsc#1201492). - CVE-2022-2031: samba, ldb: AD users can bypass certain restrictions associated with changing passwords; (bso#15047); (bsc#1201495); - CVE-2022-32742:SMB1 code does not correct verify SMB1write, SMB1write_and_close, SMB1write_and_unlock lengths; (bso#15085); (bsc#1201496). - CVE-2022-32744: samba, ldb: AD users can forge password change requests for any user; (bso#15074); (bso#15047); (bsc#1201493).- Update to 4.15.8 * Use pathref fd instead of io fd in vfs_default_durable_cookie; (bso#15042); * Setting fruit:resource = stream in vfs_fruit causes a panic; (bso#15099); * Add support for bind 9.18; (bso#14986); * logging dsdb audit to specific files does not work; (bso#15076); * vfs_gpfs with vfs_shadowcopy2 fail to restore file if original file had been deleted; (bso#15069); * netgroups support removed; (bso#15087); (bsc#1199247); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); (bsc#1199734); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * smbclient commands del & deltree fail with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556); * vfs_gpfs recalls=no option prevents listing files; (bso#15055); * waf produces incorrect names for python extensions with Python 3.11; (bso#15071); * Compile error in source3/utils/regedit_hexedit.c; (bso#15091); * ldconfig: /lib64/libsmbconf.so.0 is not a symbolic link; (bso#15108); * smbd doesn't handle UPNs for looking up names; (bso#15054); * Out-by-4 error in smbd read reply max_send clamp; (bso#14443); - Move pdb backends from package samba-libs to package samba-client-libs and remove samba-libs requirement from samba-winbind; (bsc#1200964); (bsc#1198255); - Use the canonical realm name to refresh the Kerberos tickets; (bsc#1196224); (bso#14979);- Fix smbclient commands del & deltree failing with NT_STATUS_OBJECT_PATH_NOT_FOUND with DFS; (bso#15100); (bsc#1200556).- Revert NIS support removal; (bsc#1199247);- Use requires_eq macro to require the libldb2 version available at samba-dsdb-modules build time; (bsc#1199362);- Add missing samba-client requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.7 * Share and server swapped in smbget password prompt; (bso#14831); * Durable handles won't reconnect if the leased file is written to; (bso#15022); * rmdir silently fails if directory contains unreadable files and hide unreadable is yes; (bso#15023); * SMB2_CLOSE_FLAGS_FULL_INFORMATION fails to return information on renamed file handle; (bso#15038); * vfs_shadow_copy2 breaks "smbd async dosmode" sync fallback; (bso#14957); * shadow_copy2 fails listing snapshotted dirs with shadow:fixinodes; (bso#15035); * PAM Kerberos authentication incorrectly fails with a clock skew error; (bso#15046); * username map - samba erroneously applies unix group memberships to user account entries; (bso#15041); * NT_STATUS_ACCESS_DENIED translates into EPERM instead of EACCES in SMBC_server_internal; (bso#14983); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Crash of winbind on RODC; (bso#14641); * uncached logon on RODC always fails once; (bso#14865); * KVNO off by 100000; (bso#14951); * LDAP simple binds should honour "old password allowed period"; (bso#15001); * wbinfo -a doesn't work reliable with upn names; (bso#15003); * Simple bind doesn't work against an RODC (with non-preloaded users); (bso#13879); * Uninitialized litemask in variable in vfs_gpfs module; (bso#15027); * Regression: create krb5 conf = yes doesn't work with a single KDC; (bso#15016);- Add provides to samba-client-libs package to fix upgrades from previous versions; (bsc#1197995);- Add missing samba-libs requirement to samba-winbind package; (bsc#1198255);- Update to 4.15.6 * Renaming file on DFS root fails with NT_STATUS_OBJECT_PATH_NOT_FOUND; (bso#14169); * Samba does not response STATUS_INVALID_PARAMETER when opening 2 objects with same lease key; (bso#14737); * NT error code is not set when overwriting a file during rename in libsmbclient; (bso#14938); * Fix ldap simple bind with TLS auditing; (bso#14996); * net ads info shows LDAP Server: 0.0.0.0 depending on contacted server; (bso#14674); * Problem when winbind renews Kerberos; (bso#14979); (bsc#1196224); * pam_winbind will not allow gdm login if password about to expire; (bso#8691); * virusfilter_vfs_openat: Not scanned: Directory or special file; (bso#14971); * DFS fix for AIX broken; (bso#13631); * Solaris and AIX acl modules: wrong function arguments; (bso#14974); * Function aixacl_sys_acl_get_file not declared / coredump; (bso#7239); * Regression: Samba 4.15.2 on macOS segfaults intermittently during strcpy in tdbsam_getsampwnam; (bso#14900); * Fix a use-after-free in SMB1 server; (bso#14989); * smb2_signing_decrypt_pdu() may not decrypt with gnutls_aead_cipher_decrypt() from gnutls before 3.5.2; (bso#14968); * Changing the machine password against an RODC likely destroys the domain join; (bso#14984); * authsam_make_user_info_dc() steals memory from its struct ldb_message *msg argument; (bso#14993); * Use Heimdal 8.0 (pre) rather than an earlier snapshot; (bso#14995); * Samba autorid fails to map AD users if id rangesize fits in the id range only once; (bso#14967);- Fix mismatched version of libldb2; (bsc#1196788). - Drop obsolete SuSEfirewall2 service files.- Drop obsolete Samba fsrvp v0->v1 state upgrade functionality; (bsc#1080338).- Fix ntlm authentications with "winbind use default domain = yes"; (bso#13126); (bsc#1173429); (bsc#1196308).- Fix samba-ad-dc status warning notification message by disabling systemd notifications in bgqd; (bsc#1195896); (bso#14947).- libldb version mismatch in Samba dsdb component; (bsc#1118508);- Update to 4.15.5 * CVE-2021-44141: UNIX extensions in SMB1 disclose whether the outside target of a symlink exists; (bso#14911); (bsc#1193690). * CVE-2021-44142: Out-of-Bound Read/Write on Samba vfs_fruit module; (bso#14914); (bsc#1194859). * CVE-2022-0336: Re-adding an SPN skips subsequent SPN conflict checks; bso#14950); (bsc#1195048).- CVE-2021-44141: Information leak via symlinks of existance of files or directories outside of the exported share; (bso#14911); (bsc#1193690); - CVE-2021-44142: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution; (bso#14914); (bsc#1194859); - CVE-2022-0336: Samba AD users with permission to write to an account can impersonate arbitrary services; (bso#14950); (bsc#1195048);- Update to 4.15.4 * Duplicate SMB file_ids leading to Windows client cache poisoning; (bso#14928); * Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error - NT_STATUS_BUFFER_TOO_SMALL; (bso#14932); * kill_tcp_connections does not work; (bso#14934); * Can't connect to Windows shares not requiring authentication using KDE/Gnome; (bso#14935); * smbclient -L doesn't set "client max protocol" to NT1 before calling the "Reconnecting with SMB1 for workgroup listing" path; (bso#14939); * Cross device copy of the crossrename module always fails; (bso#14940); * symlinkat function from VFS cap module always fails with an error; (bso#14941); * Fix possible fsp pointer deference; (bso#14942); * Missing pop_sec_ctx() in error path inside close_directory(); (bso#14944); * "smbd --build-options" no longer works without an smb.conf file; (bso#14945);- Use pkgconfig(krb5) as dependency for the -devel package: allow OBS to pick the right flavor of krb5-devel (full vs mini). - Do not require the 'krb5' symbol by samba-client-libs: this package has an automatic dependency due to linkage on libgssapi_krb5.so.2. Automatic deps are always better. - Do not require the 'krb5' symbol from samba-libs: samba-libs requires samba-client-libs, which in turn requires krb5 libraries. Samba-libs itself has no need for krb5 (but get it indirectly anyway).- Reorganize libs packages. Split samba-libs into samba-client-libs, samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba public libraries depending on internal samba libraries into these packages as there were dependency problems everytime one of these public libraries changed its version (bsc#1192684). The devel packages are merged into samba-devel. - Rename package samba-core-devel to samba-devel - Add python-rpm-macros to build requirements - Update the symlink create by samba-dsdb-modules to private samba ldb modules following libldb2 changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba- Update to 4.15.3 * Recursive directory delete with veto files is broken in 4.15.0; (bso#14878); * A directory containing dangling symlinks cannot be deleted by SMB2 alone when they are the only entry in the directory; (bso#14879); * SIGSEGV in rmdir_internals/synthetic_pathref - dirfsp is used uninitialized in rmdir_internals(); (bso#14892); * MaxQueryDuration not honoured in Samba AD DC LDAP; (bso#14694); * The CVE-2020-25717 username map [script] advice has undesired side effects for the local nt token; (bso#14901); (bsc#1192849); * User with multiple spaces (eg FredNurk) become un-deletable; (bso#14902); * Avoid storing NTTIME_THAW (-2) as value on disk; (bso#14127); * smbXsrv_client_global record validation leads to crash if existing record points at non-existing process; (bso#14882); * Crash in vfs_fruit asking for fsp_get_io_fd() for an XATTR call; (bso#14890); * Samba process doesn't log to logfile; (bso#14897); * set_ea_dos_attribute() fallback calling get_file_handle_for_metadata() triggers locking.tdb assert; (bso#14907); * Kerberos authentication on standalone server in MIT realm broken; (bso#14922); * Segmentation fault when joining the domain; (bso#14923); * Support for ROLE_IPA_DC is incomplete; (bso#14903); * rpcclient cannot connect to ncacn_ip_tcp services anymore; (bso#14767); * winexe crashes since 4.15.0 after popt parsing; (bso#14893); * net ads status -P broken in a clustered environment; (bso#14908); * Memory leak if ioctl(FSCTL_VALIDATE_NEGOTIATE_INFO) fails before smbd_smb2_ioctl_send; (bso#14788); * winbindd doesn't start when "allow trusted domains" is off; (bso#14899); * smbclient login without password using '-N' fails with NT_STATUS_INVALID_PARAMETER on Samba AD DC; (bso#14883); * A schannel client incorrectly detects a downgrade connecting to an AES only server; (bso#14912); * Possible null pointer dereference in winbind; (bso#14921); * Fix -k legacy option for client tools like smbclient, rpcclient, net, etc.; (bso#14846); * Add Debian 11 CI bootstrap support; (bso#14872); * Crash in recycle_unlink_internal(); (bso#14888);- Fix dependency problem upgrading from libndr0 to libndr2 and from libsamba-credentials0 to libsamba-credentials1; (bsc#1192684);- Fix regression introduced by CVE-2020-25717 patches, winbindd does not start when 'allow trusted domains' is off; (bso#14899); - Update to 4.15.2 * CVE-2016-2124: SMB1 client connections can be downgraded to plaintext authentication; (bso#12444); (bsc#1014440); * CVE-2020-25717: A user on the domain can become root on domain members; (bso#14556); (bsc#1192284); * CVE-2020-25718: Samba AD DC did not correctly sandbox Kerberos tickets issued by an RODC; (bso#14558); (bsc#1192246); * CVE-2020-25719: Samba AD DC did not always rely on the SID and PAC in Kerberos tickets; (bso#14561); (bsc#1192247); * CVE-2020-25721: Kerberos acceptors need easy access to stable AD identifiers (eg objectSid); (bso#14557); (bsc#1192505); * CVE-2020-25722: Samba AD DC did not do suffienct access and conformance checking of data stored; (bso#14564); (bsc#1192283); * CVE-2021-3738: Use after free in Samba AD DC RPC server; (bso#14468); (bsc#1192215); * CVE-2021-23192: Subsequent DCE/RPC fragment injection vulnerability; (bso#14875); (bsc#1192214); - Update to 4.15.1 * vfs_shadow_copy2: core dump in make_relative_path; (bso#14682); * Log clutter from filename_convert_internal; (bso#14685); * MacOSX compilation fixes; (bso#14862); * rodc_rwdc test flaps; (bso#14868); * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY] 'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba with embedded Heimdal; (bso#14642); * Python ldb.msg_diff() memory handling failure; (bso#14836); * "in" operator on ldb.Message is case sensitive; (bso#14845); * Release LDB 2.4.1 for Samba 4.15.1; (bso#14848); * samldb_krbtgtnumber_available() looks for incorrect string; (bso#14854); * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED; (bso#14871); * Allow special chars like "@" in samAccountName when generating the salt; (bso#14874); * Correctly ignore comments in CTDB public addresses file; (bso#14826); * Fix transit path validation; (bso#12998); * Fix that child winbindd logs to log.winbindd instead of log.wb-; (bso#14852); * SMB3 cancel requests should only include the MID together with AsyncID when AES-128-GMAC is used; (bso#14855); * Prepare to operate with MIT krb5 >= 1.20; (bso#14870); * Heimdal prefers RC4 over AES for machine accounts; (bso#14864);- Enable samba-tool without ad dc.- Adjust spec to use pam macros; (bsc#1191046).- Adjust spec for size * allow some Recommends instead Requires to be configured for cifs-utils, samba-libs-python3 & samba-gpupdate; (bsc#1182847). * remove fam, undocumented and unneeded.- Add missing build dependency on bison when building with the embedded Heimdal Kerberos- Update to 4.15.0 * Removed SMB development dialects SMB2_22, SMB2_24 and SMB3_10 * VFS layer modernized. * Add the ability to set allow/deny lists for zone transfer clients in Bind DLZ plugin * Server multi-channel support no longer experimental * Improved command line user experience, unifying the options in different commands * Winbindd no longer scans trusted domains on startup and will use enterprise principals by default. * The net utility is now able to support the offline domain join feature * New options for 'samba-tool dns zoneoptions' for aging control and to mark old records as static or dynamic * DNS tombstones are now deleted as appropriate and use a consistent timestamp format * The 'samba-tool dns update' command validates and rejects now malformed IPv4 and IPv6 addresses * The 'samba-tool domain backup' command correctly takes out locks against concurrent modification during backup when using the LMDB backend * TruACL support has been removed * NIS support has been removed- Fix 'net rpc' authentication when using the machine account; (bsc#1189017); (bso#14796);- Fix dependency problem upgrading from libndr0 to libndr1; (bsc#1189875); - Fix dependency problem upgrading from libsmbldap0 to libsmbldap2; (bsc#1189875); - Fix wrong kvno exported to keytab after net ads changetrustpw due to replication delay; (bsc#1188727); - Add Certificate Auto Enrollment Policy; (jsc#SLE-18456). - Update to 4.13.10 * s3: smbd: Ensure POSIX default ACL is mapped into returned Windows ACL for directory handles; (bso#14708); * Take a copy to make sure we don't reference free'd memory; (bso#14721); * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722); * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in change_file_owner_to_parent() error path; (bso#14736); * samba-tool: Give better error information when the 'domain backup restore' fails with a duplicate SID; (bso#14575); * smbd: Correctly initialize close timestamp fields; (bso#14714); * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740); * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475); * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750); * smbXsrv_{open,session,tcon}: Protect smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752); * samba-tool domain backup offline doesn't work against bind DLZ backend; (bso#14027); * netcmd: Use next_free_rid() function to calculate a SID for restoring a backup; (bso#14669); - Update to 4.13.9 * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696); * Add documentation for dsdb_group_audit and dsdb_group_json_audit to "log level", synchronise "log level" in smb.conf with the code; (bso#14689); * Fix smbd panic when two clients open same file; (bso#14672); * Fix memory leak in the RPC server; (bso#14675); * s3: smbd: Fix deferred renames; (bso#14679); * s3-iremotewinspool: Set the per-request memory context; (bso#14675); * rpc_server3: Fix a memleak for internal pipes; (bso#14675); * third_party: Update socket_wrapper to version 1.3.2; (bso#11899); * third_party: Update socket_wrapper to version 1.3.3; (bso#14639); * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid conflict; (bso#14663); * Fix the build on OmniOS; (bso#14288); - Update to 4.13.8 * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571 - Update to 4.13.7 * Release with dependency on ldb version 2.2.1.- CVE-2021-20254 Buffer overrun in sids_to_unixids(); (bnc#14571); (bsc#1184677).- Fix offline domain backup not possible using lmdb version >= 0.9.26; (bso#14676); - Require libldb >= 2.2.1; (bsc#1183572); (bsc#1183574); - Update to 4.13.6 * CVE-2020-27840: samba: Unauthenticated remote heap corruption via bad DNs; (bso#14595); (bsc#1183572). * CVE-2021-20277: samba: out of bounds read in ldb_handler_fold; (bso#14655); (bsc#1183574). - Update to 4.13.5 * s3:modules:vfs_virusfilter: Recent talloc changes cause infinite start-up failure; (bso#14634); * s3: libsmb: Add missing cli_tdis() in error path if encryption setup failed on temp proxy connection; (bso#13992); * smbd: In conn_force_tdis_done() when forcing a connection closed force a full reload of services; (bso#14604); * dbcheck: Check Deleted Objects and reduce noise in reports about expired tombstones (bso#14593); * s3: Fix fcntl waf configure check; (bso#14503); * s3/auth: Implement "winbind:ignore domains"; (bso#14602); * smbd: Use fsp->conn->session_info for the initial delete-on-close token; (bso#14617); * s3: VFS: nfs4_acls. Add missing TALLOC_FREE(frame) in error path; (bso#14648); * classicupgrade: Treat old never expires value right; (bso#14624); * g_lock: Fix uninitalized variable reads; (bso#14636); * s3:pysmbd: Fix fd leak in py_smbd_create_file(); (bso#13898); * lib:util: Avoid free'ing our own pointer; (bso#14625); * HEIMDAL: krb5_storage_free(NULL) should work; (bso#12505);- Spec file fixes around systemd and requires; (bsc#1182830); - Align systemd service unit files with upstream provided ones.- Update to 4.13.4 * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * lib: Avoid declaring zero-length VLAs in various messaging functions; (bso#14605); * Do not create an empty DB when accessing a sam.ldb; (bso#14579); * vfs_fruit may close wrong backend fd; (bso#14596); * Temporary DFS share setup doesn't set case parameters in the same way as a regular share definition does; (bso#14612); * vfs_virusfilter: Allocate separate memory for config char*; (bso#14606); * vfs_fruit may close wrong backend fd; (bso#14596); * Work around special SMB2 IOCTL response behavior of NetApp Ontap 7.3.7; (bso#14607); * The cache directory for the user gencache should be created recursively; (bso#14601); * Be more flexible with repository names in CentOS 8 test environments; (bso#14594);- Uninstalling samba-client: Failed to disable unit, cifs.service does not exists; (bsc#1180388);- Update to 4.13.3 + libcli: smb2: Never print length if smb2_signing_key_valid() fails for crypto blob; (bso#14210); + s3: modules: gluster. Fix the error I made in preventing talloc leaks from a function; (bso#14486); + s3: smbd: Don't overwrite contents of fsp->aio_requests[0] with NULL via TALLOC_FREE(); (bso#14515); + s3: spoolss: Make parameters in call to user_ok_token() match all other uses; (bso#14568); + s3: smbd: Quiet log messages from usershares for an unknown share; (bso#14590); + samba process does not honor max log size; (bso#14248); + vfs_zfsacl: Add missing inherited flag on hidden "magic" everyone@ ACE; (bso#14587); + s3-libads: Pass timeout to open_socket_out in ms; (bso#13124); + s3-vfs_glusterfs: Always disable write-behind translator; (bso#14486); + smbclient: Fix recursive mget; (bso#14517); + clitar: Use do_list()'s recursion in clitar.c; (bso#14581); + manpages/vfs_glusterfs: Mention silent skipping of write-behind translator; (bso#14486); + vfs_shadow_copy2: Preserve all open flags assuming ROFS; (bso#14573); + interface: Fix if_index is not parsed correctly; (bso#14514);- Update to 4.13.2 + s3: modules: vfs_glusterfs: Fix leak of char **lines onto mem_ctx on return; (bso#14486); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471); + smb.conf.5: Add clarification how configuration changes reflected by Samba; (bso#14538); + daemons: Report status to systemd even when running in foreground; (bso#14552); + DNS Resolver: Support both dnspython before and after 2.0.0; (bso#14553); + s3-vfs_glusterfs: Refuse connection when write-behind xlator is present; (bso#14486); + provision: Add support for BIND 9.16.x; (bso#14487); + ctdb-common: Avoid aliasing errors during code optimization; (bso#14537); + libndr: Avoid assigning duplicate versions to symbols; (bso#14541); + docs: Fix default value of spoolss:architecture; (bso#14522); + winbind: Fix a memleak; (bso#14388); + s4:dsdb:acl_read: Implement "List Object" mode feature; (bso#14531); + docs-xml/manpages: Add warning about write-behind translator for vfs_glusterfs; (bso#14486); + nsswitch/nsstest.c: Avoid nss function conflicts with glibc nss.h. + vfs_shadow_copy2: Avoid closing snapsdir twice; (bso#14530); + third_party: Update resolv_wrapper to version 1.1.7; (bso#14547); + examples:auth: Do not install example plugin; (bso#14550); + ctdb-recoverd: Drop unnecessary and broken code; (bso#14513); + RN: vfs_zfsacl: Only grant DELETE_CHILD if ACL tag is special; (bso#14471);- Adjust smbcacls '--propagate-inheritance' feature to align with upstream; (bsc#1178469).- Update to samba 4.13.1 + CVE-2020-14383: An authenticated user can crash the DCE/RPC DNS with easily crafted records; (bsc#1177613); (bso#14472); + CVE-2020-14323: Unprivileged user can crash winbind; (bsc#1173994); (bso#14436); + CVE-2020-14318: Missing handle permissions check in SMB1/2/3 ChangeNotify; (bsc#1173902); (bso#14434); - Adjust systemd tmpfiles.d configuration, use /run/samba instead of /var/run/samba; (bsc#1177355);- Fix vfs_ceph query_directory regression; (bso#14519) - Drop liburing-devel for SLE15-SP2; (bsc#1177245)- Register CTDB recovery lock holder with ceph-mgr - Add liburing-devel dependency- Update to samba 4.13.0 + Require Python 3.6 + Move wide links functionality into VFS module + Deprecate NT4-like 'classic' Samba domain controllers + Deprecate SMBv1 only protocol options + Remove deprecated "ldap ssl ads" option + Unify asynchronous DCE-RPC server; (jsc#SES-645) + Replay multichannel lease break requests; (bso#11897); (jsc#SES-655) + Drop internal byteorder.h header from util-devel package + Remove final code for the AD DC LDAP backend + Add AD DC Group Policy Scripts + Only use gnutls_aead_cipher_encryptv2() for GnuTLS > 3.6.14; (bso#14399) + Fix %U substitutions if it contains a domain name; (bso#14467) + Fix krb5.conf creation for 'net ads join'; (bso#14479) + Fix build problem if libbsd-dev is not installed; (bso#14482) + Toggle vfs_snapper using "--with-shared-modules"; (bso#14437) + Fix idmap_ad RFC4511 response handling; (bso#14465) + Fix panic in get_lease_type(); (bso#14428)- Update to samba 4.11.13 + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Protect netr_ServerPasswordSet2 against unencrypted passwords; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s3:rpc_server/netlogon: Support "server require schannel:WORKSTATION$ = no" about unsecure configurations; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): s4 torture rpc: repeated bytes in client challenge; (bsc#1176579); (bso#14497); + CVE-2020-1472(ZeroLogon): libcli/auth: Reject weak client challenges in netlogon_creds_server_init() "server require schannel:WORKSTATION$ = no"; (bsc#1176579); (bso#14497); - Update to samba 4.11.12 + s3: libsmb: Fix SMB2 client rename bug to a Windows server; (bso#14403); + dsdb: Allow "password hash userPassword schemes = CryptSHA256" to work on RHEL7; (bso#14424); + dbcheck: Allow a dangling forward link outside our known NCs; (bso#14450); + lib/debug: Set the correct default backend loglevel to MAX_DEBUG_LEVEL; (bso#14426); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + lib/util: do not install "test_util_paths"; (bso#14370); + lib:util: Fix smbclient -l basename dir; (bso#14345); + s3:smbd: PANIC: assert failed in get_lease_type(); (bso#14428); + util: Allow symlinks in directory_create_or_exist; (bso#14166); + docs: Fix documentation for require_membership_of of pam_winbind; (bso#14358); + s3:winbind:idmap_ad: Make failure to get attrnames for schema mode fatal; (bso#14425);- Add obsoletes to libsmbldap2 package to fix upgrades from previous versions; (bsc#1172810);- Fix net command unable to negotiate SMB2; (bsc#1174120);- Update to samba 4.11.11 + CVE-2020-10730: NULL de-reference in AD DC LDAP server when ASQ and VLV combined; (bso#14364); (bsc#1173159] + CVE-2020-10745: invalid DNS or NBT queries containing dots use several seconds of CPU each; (bso#14378); (bsc#1173160). + CVE-2020-10760: Use-after-free in AD DC Global Catalog LDAP server with paged_result or VLV; (bso#14402); (bsc#1173161) + CVE-2020-14303: Endless loop from empty UDP packet sent to AD DC nbt_server; (bso#14417); (bsc#1173359). - Update to samba 4.11.10 + Fix segfault when using SMBC_opendir_ctx() routine for share folder that contains incorrect symbols in any file name; (bso#14374). + vfs_shadow_copy2 doesn't fail case looking in snapdirseverywhere mode; (bso#14350) + ldb_ldap: Fix off-by-one increment in lldb_add_msg_attr; (bso#14413). + Malicous SMB1 server can crash libsmbclient; (bso#14366) + winbindd: Fix a use-after-free when winbind clients exit; (bso#14382) + ldb: Bump version to 2.0.11, LMDB databases can grow without bounds. (bso#14330) - Update to samba 4.11.9 + nmblib: Avoid undefined behaviour in handle_name_ptrs(); (bso#14242). + 'samba-tool group' commands do not handle group names with special chars correctly; (bso#14296). + smbd: avoid calling vfs_file_id_from_sbuf() if statinfo is not valid; (bso#14237). + Missing check for DMAPI offline status in async DOS attributes; (bso#14293). + smbd: Ignore set NTACL requests which contain S-1-5-88 NFS ACEs; (bso#14307). + vfs_recycle: Prevent flooding the log if we're called on non-existant paths; (bso#14316) + smbd mistakenly updates a file's write-time on close; (bso#14320). + RPC handles cannot be differentiated in source3 RPC server; (bso#14359). + librpc: Fix IDL for svcctl_ChangeServiceConfigW; (bso#14313). + nsswitch: Fix use-after-free causing segfault in _pam_delete_cred; (bso#14327). + Fix fruit:time machine max size on arm; (bso#13622) + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294). + ctdb: Fix a memleak; (bso#14348). + libsmb: Don't try to find posix stat info in SMBC_getatr(). + ctdb-tcp: Move free of inbound queue to TCP restart; (bso#14295); (bsc#1162680). + s3/librpc/crypto: Fix double free with unresolved credential cache; (bso#14344); (bsc#1169095) + s3:libads: Fix ads_get_upn(); (bso#14336). + CTDB recovery corner cases can cause record resurrection and node banning; (bso#14294) + Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680). + ctdb-recoverd: Avoid dereferencing NULL rec->nodemap; (bso#14324) - Update to samba 4.11.8 + CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850); + CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - Update to samba 4.11.7 + s3: lib: nmblib. Clean up and harden nmb packet processing; (bso#14239). + s3: VFS: full_audit. Use system session_info if called from a temporary share definition; (bso#14283) + dsdb: Correctly handle memory in objectclass_attrs; (bso#14258). + ldb: version 2.0.9, Samba 4.11 and later give incorrect results for SCOPE_ONE searches; (bso#14270) + auth: Fix CIDs 1458418 and 1458420 Null pointer dereferences; (bso#14247). + smbd: Handle EINTR from open(2) properly; (bso#14285) + winbind member (source3) fails local SAM auth with empty domain name; (bso#14247) + winbindd: Handling missing idmap in getgrgid(); (bso#14265). + lib:util: Log mkdir error on correct debug levels; (bso#14253). + wafsamba: Do not use 'rU' as the 'U' is deprecated in Python 3.9; (bso#14266). + ctdb-tcp: Make error handling for outbound connection consistent; (bso#14274). - Update to samba 4.11.6 + pygpo: Use correct method flags; (bso#14209). + vfs_ceph_snapshots: Fix root relative path handling; (bso#14216); (bsc#1141320). + Avoiding bad call flags with python 3.8, using METH_NOARGS instead of zero; (bso#14209). + source4/utils/oLschema2ldif: Include stdint.h before cmocka.h; (bso#14218). + docs-xml/winbindnssinfo: Clarify interaction with idmap_ad etc; (bso#14122). + smbd: Fix the build with clang; (bso#14251). + upgradedns: Ensure lmdb lock files linked; (bso#14199). + s3: VFS: glusterfs: Reset nlinks for symlink entries during readdir; (bso#14182). + smbc_stat() doesn't return the correct st_mode and also the uid/gid is not filled (SMBv1) file; (bso#14101). + librpc: Fix string length checking in ndr_pull_charset_to_null(); (bso#14219). + ctdb-scripts: Strip square brackets when gathering connection info; (bso#14227).- Add libnetapi-devel to baselibs conf, for wine usage; (bsc#1172307);- Installing: samba - samba-ad-dc.service does not exist and unit not found; (bsc#1171437);- Fix samba_winbind package is installing python3-base without python3 package; (bsc#1169521);- Require libldb2 >= 2.0.10 after security release.- CVE-2020-10704: LDAP Denial of Service (stack overflow) in Samba AD DC; (bso#14334); (bsc#1169851); - CVE-2020-10700: Use-after-free in Samba AD DC LDAP Server with ASQ; (bso#14331); (bsc#1169850);- Fix smbclient crash with double free (with unresolved krb5 credential cache); (bso#14344); (bsc#1169095).- Starting ctdb node that was powered off hard before results in recovery loop; (bso#14295); (bsc#1162680).- CTDB doesn't retry outgoing connections on bind (and some other) failures; (bso#14274); (bsc#1162680).- Revert: Allow idmap_rid to have primary group other than "Domain Users"; (bsc#1087931).- Fix nmbstatus not reporting detailed information about workgroups; (bsc#1159464); - Fix querying all names registered within broadcast area; (bso#8927);- Update to samab 4.11.5 + CVE-2019-14902: Replication of ACLs down subtree on AD Directory is not automatic; (bso#12497); (bsc#1160850). + CVE-2019-19344: Fix server crash with dns zone scavenging = yes; (bso#14050); (bsc#1160852). + CVE-2019-14907: server-side crash after charset conversion failure (eg during NTLMSSP processing); (bso#14208); (bsc#1160888). - Update to samba 4.11.4 + Ensure SMB1 cli_qpathinfo2() doesn't return an inode number; (bso#14161). + Ensure we don't call cli_RNetShareEnum() on an SMB1 connection; (bso#14174). + NT_STATUS_ACCESS_DENIED becomes EINVAL when using SMB2 in SMBC_opendir_ctx; (bso#14176). + SMB2 - Ensure we use the correct session_id if encrypting an interim response; (bso#14189). + Prevent smbd crash after invalid SMB1 negprot; (bso#14205). + printing: Fix %J substition; (bso#13745). + Remove now unneeded call to cmdline_messaging_context(); (bso#13925). + Fix incomplete conversion of former parametric options; (bso#14069). + Fix sync dosmode fallback in async dosmode codepath; (bso#14070). + vfs_fruit returns capped resource fork length; (bso#14171). + libnet_join: Add SPNs for additional-dns-hostnames entries; (bso#14116). + smbd: Increase a debug level; (bso#14211). + Prevent azure ad connect from reporting discovery errors reference-value-not-ldap-conformant; (bso#14153). + krb5_plugin: Fix developer build with newer heimdal system library; (bso#14179). + replace: Only link libnsl and libsocket if required; (bso#14168); + ctdb: Incoming queue can be orphaned causing communication; breakdown; (bso#14175). + ldb: Release ldb 2.0.8. Cross-compile will not take cross-answers or cross-execute; (bso#13846). + heimdal-build: Avoid hard-coded /usr/include/heimdal in asn1_compile-generated code; (bso#13856).- Fix Ceph snapshot root relative path handling; (bso#14216); (bsc#1141320).- Update to samba 4.11.3 + CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). + CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- CVE-2019-14861: DNSServer RPC server crash, an authenticated user can crash the DCE/RPC DNS management server by creating records with matching the zone name; (bso#14138); (bsc#1158108). - CVE-2019-14870: DelegationNotAllowed not being enforced, the DelegationNotAllowed Kerberos feature restriction was not being applied when processing protocol transition requests (S4U2Self), in the AD DC KDC; (bso#14187); (bsc#1158109).- Update to samba 4.11.2 + CVE-2019-10218: Client code can return filenames containing path separators; (bsc#1144902); (bso#14071). + CVE-2019-14833: Samba AD DC check password script does not receive the full password; (bso#12438). + CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040). - Fixes from 4.11.1 + Overlinking libreplace against librt and pthread against every binary or library causes issues; (bso#14140); + kpasswd fails when built with MIT Kerberos; (bso#14155); + Fix spnego fallback from kerberos to ntlmssp in smbd server; (bso#14106); + Stale file handle error when using mkstemp on a share; (bso#14137); + non-AES schannel broken; (bso#14134); + Joining Active Directory should not use SAMR to set the password; (bso#13884); + smbclient can blunder into the SMB1 specific cli_RNetShareEnum() call on an SMB2 connection; (bso#14152); + Deleted records can be resurrected during recovery; (bso#14147); + getpwnam and getpwuid need to return data for ID_TYPE_BOTH group; (bso#14141); + winbind does not list forest trusts with additional trust attributes; (bso#14130); + fault report points to outdated documentation; (bso#14139); + pam_winbind with krb5_auth or wbinfo -K doesn't work for users of trusted domains/forests; (bso#14124); + classicupgrade results in uncaught exception - a bytes-like object is required, not 'str'; (bso#14136); + pod2man is not longer required, stop checking at build time; (bso#14131); + Exit code of ctdb nodestatus should not be influenced by deleted nodes; (bso#14129); + username/password authentication doesn't work with CUPS and smbspool; (bso#14128); + smbc_readdirplus() is incompatible with smbc_telldir() and smbc_lseekdir(); (bso#14094);- CVE-2019-14847: User with "get changes" permission can crash AD DC LDAP server via dirsync; (bso#14040); (bsc#1154598); - CVE-2019-10218: Client code can return filenames containing path separators; (bso#14071); (bsc#1144902);- CVE-2019-14833: samba: Accent with "check script password" Samba AD DC check password script does not receive the full password; (bso#12438); (bsc#1154289).- Update to samba 4.11.0 + For details on all items see WHATSNEW.txt in samba-doc package + Python2 runtime support removed; python 3.4 or later required + Security improvements: - SMB1 disabled by default - lanman and plaintext authentication deprecated - winbind: PAM_AUTH and NTLM_AUTH events logged - GnuTLS 3.2 required; system FIPS mode setting honored + CephFS Snapshot integration, exposed as previous file versions + ctdb changes: - onnode -o option removed - ctdbd logs when using more than 90% of a CPU thread - CTDB_MONITOR_SWAP_USAGE variable removed + AD Domain controller improvements: - Upgrade AD databse format - BIND9_FLATFILE deprecated - default process model chagned to prefork - bind9 dns operation duration logging - Default schema updated to 2012_R2; function level is unchanged - many performance improvements + Configuration webserver support removed- Fix broken username/password authentication with CUPS and smbspool; (bsc#1152143); (bso#14128).- Fix auth problems when printing via smbspool backend with kerberos; (bnc#1148539); (bso#13832).- Update to samba 4.10.8 + CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267);- Fix build on newer systems by modifying samba.spec to use consistent non-relative paths for pammodules in configure line and specification of pam_winbind.so library to package.- Update to samba 4.10.7 + Unable to create or rename file/directory inside shares configured with vfs_glusterfs_fuse module; (bso#14010). + build: Allow build when '--disable-gnutls' is set; (bso#13844) + samba-tool: Add 'import samba.drs_utils' to fsmo.py; (bso#13973). + Fix 'Error 32 determining PSOs in system' message on old DB with FL upgrade; (bso#14008). + s4/libnet: Fix joining a Windows pre-2008R2 DC; (bso#14021) + join: Use a specific attribute order for the DsAddEntry nTDSDSA object; (bso#14046). + vfs_catia: Pass stat info to synthetic_smb_fname(); (bso#14015). + lookup_name: Allow own domain lookup when flags == 0; (bso#14091). + s4 librpc rpc pyrpc: Ensure tevent_context deleted last; (bso#13932). + DEBUGC and DEBUGADDC doesn't print into a class specific log file; (bso#13915). + Request to keep deprecated option "server schannel", VMWare Quickprep requires "auto"; (bso#13949). + dbcheck: Fallback to the default tombstoneLifetime of 180 days; (bso#13967). + dnsProperty fails to decode values from older Windows versions; (bso#13969). + samba-tool: Use only one LDAP modify for dns partition fsmo role transfer; (bso#13973). + third_party: Update waf to version 2.0.17; (bso#13960). + netcmd: Allow 'drs replicate --local' to create partitions; (bso#14051). + ctdb-config: Depend on /etc/ctdb/nodes file; (bso#14017).- CVE-2019-10197: user escape from share path definition; (bso#14035); (bsc#1141267).- Prepare for use future use of kernel keyrings, modify /etc/pam.d/samba to include pam_keyinit.so; (bsc#1144059).- Update samba-winbind script to work with systemd; (bsc#1132739); - Drop samba dhcpcd hook scripts - Update to samba 4.10.6 + s3: winbind: Fix crash when invoking winbind idmap scripts; (bso#13956). + smbd does not correctly parse arguments passed to dfree and quota scripts; (bso#13964). + samba-tool dns: use bytes for inet_ntop; (bso#13965). + samba-tool domain provision: Fix --interactive module in python3; (bso#13828). + ldb_kv: Skip @ records early in a search full scan; (bso#13893). + docs: Improve documentation of "lanman auth" and "ntlm auth" connection; (bso#13981). + python/ntacls: Use correct "state directory" smb.conf option instead of "state dir"; (bso#14002). + registry: Add a missing include; (bso#13840). + Fix SMB guest authentication; (bso#13944). + AppleDouble conversion breaks Resourceforks; (bso#13958). + vfs_fruit makes direct use of syscalls like mmap() and pread(); (bso#13968). + s3:mdssvc: Fix flex compilation error; (bso#13987). + s3/vfs_glusterfs[_fuse]: Avoid using NAME_MAX directly; (bso#13872). + dsdb:samdb: schemainfo update with relax control; (bso#13799). + s3:util: Move static file_pload() function to lib/util; (bso#13964). + smbd: Fix a panic; (bso#13957). + ldap server: Generate correct referral schemes; (bso#12478). + s4 dsdb/repl_meta_data: fix use after free in dsdb_audit_add_ldb_value; (bso#13941). + s4 dsdb: Fix use after free in samldb_rename_search_base_callback; (bso#13942). + dsdb/repl: we need to replicate the whole schema before we can apply it; (bso#12204). + ldb: Release ldb 1.5.5; (bso#12478). + Schema replication fails if link crosses chunk boundary backwards; (bso#13713). + 'samba-tool domain schemaupgrade' uses relax control and skips the schemaInfo update provision; (bso#13799). + dsdb_audit: avoid printing "... remote host [Unknown] SID [(NULL SID)] ..."; (bso#13916). + python/ntacls: We only need security.SEC_STD_READ_CONTROL in order to get the ACL; (bso#13917). + s3:loadparm: Ensure to truncate FS Volume Label at multibyte boundary; (bso#13947). + Using Kerberos credentials to print using spoolss doesn't work; (bso#13939). + wafsamba: Use native waf timer; (bso#13998). + ctdb-scripts: Fix tcp_tw_recycle existence check; (bso#13984).- Update to samba-4.10.5 (including updates for 4.10.4, 4.10.3) + CVE-2019-12435 rpc/dns: Avoid NULL deference if zone not found in DnssrvOperation2; (bso#13922); (bsc#1137815). + CVE-2019-12436 dsdb/paged_results: Ignore successful results without messages; (bso#13951); (bsc#1137816). - Update to samba-4.10.4 + s3: SMB1: Don't allow recvfile on stream fsp's; (bso#13938). + py/provision: Fix for Python 2.6; (bso#13882). + netcmd: Fix 'passwordsettings --max-pwd-age' command; (bso#13873). + s3-libnet_join: 'net ads join' to child domain fails when using "-U admin@forestroot"; (bso#13861). + vfs_ceph: Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245). + vfs_ceph: Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). + ctdb-common: Avoid race between fd and signal events; (bso#13895). + ctdb-common: Fix memory leak in run_proc; (bso#13943). + lib: Initialize getline() arguments; (bso#13892). + winbind: Fix overlapping id ranges; (bco#13903). + lib util debug: Increase format buffer to 4KiB; (bso#13902). + nsswitch pam_winbind: Fix Asan use after free; (bso#13927). + s4 lib socket: Ensure address string owned by parent struct; (bso#13929). + s3 rpc_client: Fix Asan stack use after scope; (bso#13936). + s3:smbd: Handle IO_REPARSE_TAG_DFS in SMB_FIND_FILE_FULL_DIRECTORY_INFO; (bso#10097). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#10344). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#12845). + smb2_tcon: Avoid STATUS_PENDING completely on tdis; (bso#13698). + smb2_sesssetup: avoid STATUS_PENDING responses for session setup; (bso#13796). + dbcheck: Fix the err_empty_attribute() check; (bso#13843). + vfs_snapper: Drop unneeded fstat handler; (bso#13858). + vfs_default: Fix vfswrap_offload_write_send() NT_STATUS_INVALID_VIEW_SIZE check; (bso#13862). + smb2_server: Grant all 8192 credits to clients; (bso#13863). + smbd: Implement SMB_FILE_NORMALIZED_NAME_INFORMATION handling; (bso#13919). + s3/vfs_glusterfs: Dynamically determine NAME_MAX; (bso#13872). + s3: modules: ceph: Use current working directory instead of share path; (bso#13918); (bsc#1134452). + winbind: Use domain name from lsa query for sid_to_name cache entry; (bso#13831). + memcache: Increase size of default memcache to 512k; (bso#13865). + docs: Update smbclient manpage for "--max-protocol"; (bso#13857). + s3:utils: If share is NULL in smbcacls, don't print it; (bso#13937). + s3:smbspool: Fix regression printing with Kerberos credentials; (bso#13939). + ctdb-scripts: CTDB restarts failed NFS RPC services by hand, which is incompatible with systemd; (bso#13860). + ctdb-daemon: Revert "We can not assume that just because we could complete a TCP handshake"; (bso#13888). + ctdb-daemon: Never use 0 as a client ID; (bso#13930). + ctdb-common: Fix memory leak; (bso#13943). + s3:debug: Enable logging for early startup failures; (bso#13904) - Update to samba-4.10.3 + CVE-2018-16860: Heimdal KDC: Reject PA-S4U2Self with unkeyed checksum; (bso#13685); (bsc#1134024).- CVE-2019-12435: zone operations can crash rpc server; (bso#13922); (bsc#1137815).- Fix cephwrap_flistxattr() debug message; (bso#13940); (bsc#1134697). - Add ceph_snapshots VFS module; (jsc#SES-183).- Fix vfs_ceph realpath; (bso#13918); (bsc#1134452).- Update to samba-4.10.2: + CVE-2019-3870 (World writable files in Samba AD DC private/ dir); (bso#13834). + CVE-2019-3880 (Save registry file outside share as unprivileged user); (bso#13851). + py/kcc_utils: py2.6 compatibility; (bso#13837). + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869). + regfio: Improve handling of malformed registry hive files; (bso#13840). + ctdb-version: Simplify version string usage; (bso#13789). + lib: Make fd_load work for non-regular files; (bso#13859). + dbcheck: in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816). + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818). + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854). + acl_read: Fix regression for empty lists; (bso#13836). + s4:dlz make b9_has_soa check dc=@ node; (bso#13841). + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832). + s4:librpc: Fix installation of Samba; (bso#13847). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793). + s3:lib: Fix the debug message for adding cache entries; (bso#13848). + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853). * ctdb-build: Drop creation of .distversion in tarball; (bso#13789). * ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838). - Update to samba-4.10.1: + py/kcc_utils: py2.6 compatibility; (bso#13837); + libcli: permit larger values of DataLength in SMB2_ENCRYPTION_CAPABILITIES of negotiate response; (bso#13869); + regfio: Improve handling of malformed registry hive files; (bso#13840); + ctdb-version: Simplify version string usage; (bso#13789); + lib: Make fd_load work for non-regular files; (bso#13859); + dbcheck in the middle of the tombstone garbage collection causes replication failures, dbcheck: add --selftest-check-expired-tombstones cmdline option; (bso#13816); + ndr_spoolss_buf: Fix out of scope use of stack variable in NDR_SPOOLSS_PUSH_ENUM_OUT(); (bso#13818); + s4/messaging: Fix undefined reference in linking libMESSAGING-samba4.so; (bso#13854); + acl_read: Fix regression for empty lists; (bso#13836); + s4:dlz make b9_has_soa check dc=@ node; (bso#13841); + s3:client: Fix printing via smbspool backend with kerberos auth; (bso#13832); + s4:librpc: Fix installation of Samba; (bso#13847); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:utils: Add 'smbstatus -L --resolve-uids' to show username; (bso#13793); + s3:lib: Fix the debug message for adding cache entries; (bso#13848); + s3:waf: Fix the detection of makdev() macro on Linux; (bso#13853); + ctdb-build: Drop creation of .distversion in tarball; (bso#13789); + ctdb-packaging: Test package requires tcpdump, ctdb package should not own system library directory; (bso#13838); - Update to samba-4.10.0: + s4-server: Open and close a transaction on sam.ldb at startup; (bso#13760); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s4/scripting/bin: Open unicode files with utf8 encoding and write + unicode string. + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + Fix idmap cache pollution with S-1-22- IDs on winbind hickup; (bso#13813); + passdb: Update ABI to 0.27.2. + lib/winbind_util: Add winbind_xid_to_sid for --without-winbind; (bso#13813); + lib:util: Move debug message for mkdir failing to log level 1; (bso#13823);- MacOS credit accounting breaks with async SESSION SETUP; (bsc#1125601); (bso#13796). - Mac OS X SMB2 implmenetation sees Input/output error or Resource temporarily unavailable and drops connection; (bso#13698)- Explicitly enable libcephfs POSIX ACL support; (bso#13896); (bsc#1130245).- CVE-2019-3880: Save registry file outside share as unprivileged user; (bso#13851); (bsc#1131060 ).- CVE-2019-3870 pysmbd: missing restoration of original umask after umask(0); (bso#13834); (bsc#1130703);- Update to samba-4.9.5 + audit_logging: Remove debug log header and JSON Authentication: prefix; (bso#13714); + Fix upgrade from 4.7 (or earlier) to 4.9; (bso#13760); + s3: lib: nmbname: Ensure we limit the NetBIOS name correctly; (bso# CID: 1433607; (bso#11495); + smbd: uid: Don't crash if 'force group' is added to an existing share connection; (bso#13690); + s3: VFS: vfs_fruit. Fix the NetAtalk deny mode compatibility code; (bso#13770); + s3: SMB1 POSIX mkdir does case insensitive name lookup; (bso#13803); + s3:utils/smbget fix recursive download with empty source directories; (bso#13199); + samba-tool drs showrepl: Do not crash if no dnsHostName found; (bso#13716); + s3:libsmb: cli_smb2_list() can sometimes fail initially on a connection; (bso#13736); + join: Throw CommandError instead of Exception for simple errors; (bso#13747); + ldb: Avoid inefficient one-level searches; (bso#13762); + s3: libsmb: use smb2cli_conn_max_trans_size() in cli_smb2_list(); (bso#13736); + tldap: Avoid use after free errors; (bso#13776); + Fix idmap xid2sid cache churn; (bso#13802); + access_check_max_allowed() doesn't process "Owner Rights" ACEs; (bso#13812); + s3-smbd: Avoid assuming fsp is always intact after close_file call; (bso#13720); + s3-vfs-fruit: Add close call; (bso#13725); + s3-smbd: Use fruit:model string for mDNS registration; (bso#13746); + s3-vfs: add glusterfs_fuse vfs module; (bso#13774); + printing: Check lp_load_printers() prior to pcap cache update; (bso#13766); + vfs_ceph: vfs_ceph strict_allocate_ftruncate calls (local FS) ftruncate and fallocate; (bso#13807); + lib/audit_logging: Actually create talloc; (bso#13737); + netcmd/user: python[3]-gpgme unsupported and replaced by python[3]-gpg; (bso#13728); + dns: Changing onelevel search for wildcard to subtree; (bso#13738); + samba-tool: Don't print backtrace on simple DNS errors; (bso#13721); + sambaundoguididx: Use the right escaped oder unescaped sam ldb files; (bso#13759); + ctdb: Print locks latency in machinereadable stats; (bso#13742); + messages_dgm: Messaging gets stuck when pids are recycled; (bso#13786); + audit_logging: auth_json_audit required auth_json; (bso#13715); + man pages: Document prefork process model; (bso#13765); + CVE-2019-3824 ldb: Release ldb 1.4.6; (bso#13773); + s3:auth: ignore create_builtin_guests() failing without a valid idmap configuration; (bso#13697); + s3:auth_winbind: Ignore a missing winbindd as NT4 PDC/BDC without trusts; (bso#13722); + s3:auth_winbind: return NT_STATUS_NO_LOGON_SERVERS if winbindd is not available; (bso#13723); + s4:server: Add support for 'smbcontrol samba shutdown' and 'smbcontrol debug/debuglevel'; (bso#13752); + Python: Ensure ldb.Dn can doesn't rencoded str with py2; (bso#13616); + vfs_glusterfs: Adapt to changes in libgfapi signatures; (bso#13330); + s3-vfs: Use ENOATTR in errno comparison for getxattr; (bso#13774); + notifyd: Fix SIGBUS on sparc; (bso#13704); + waf: Check for libnscd; (bso#13787); + s3:vfs: Correctly check if OFD locks should be enabled or not; (bso#13770); + lib/util: Count a trailing line that doesn't end in a newline; (bso#13717); + Recovery lock bug fixes; (bso#13800); + s3: net: Do not set NET_FLAGS_ANONYMOUS with -k; (bso#13726); + s3:libsmb: Honor disable_netbios option in smbsock_connect_send; (bso#13727); + vfs_fileid: Fix get_connectpath_ino; (bso#13741); + vfs_fileid: Fix fsname_norootdir algorithm; (bso#13744);- Fix vfs_ceph ftruncate and fallocate handling; (bso#13807); (bsc#1127153).- Fix update-apparmor-samba-profile script after apparmor switched to using named profiles. The change is backwards compatible; (bsc#1126377);- LoadParm().load_default() fails with "Unable to load default file"; (bsc#1089758);- Abide by load_printers smb.conf parameter; (bso#13766); (bsc#1124223);- Update to samba-4.9.4 + libcli/smb: Don't overwrite status code; (bso#9175). + wbinfo --group-info 'NT AUTHORITY\System' does not work; (bso#12164). + Session setup reauth fails to sign response; (bso#13661). + vfs_fruit: Validation of writes on AFP_AfpInfo stream; (bso#13677). + vfs_shadow_copy2: Nicely deal with attempts to open previous version for writing; (bso#13688). + Restoring previous version of stream with vfs_shadow_copy2 fails with NT_STATUS_OBJECT_NAME_INVALID fsp->base_fsp->fsp_name; (bso#13455). + CVE-2018-16853: Fix S4U2Self crash with MIT KDC build; (bso#13571). + s3-vfs: Prevent NULL pointer dereference in vfs_glusterfs; (bso#13708) + PEP8: fix E231: missing whitespace after ','. + winbindd: Fix crash when taking profiles;(bso#13629) + CVE-2018-14629 dns: Fix CNAME loop prevention using counter regression; (bso#13600) + 'samba-tool user syscpasswords' fails on a domain with many DCs; (bso#13686). + CVE-2018-16853: Do not segfault if client is not set; (bso#13571). + lib:util: Fix DEBUGCLASS pointer initializiation; (bso#13679) + ctdb-daemon: Exit with error if a database directory does not exist; (bso#13696). + s3:libads: Add net ads leave keep-account option; (bso#13498).- Drop more %if..%endif guards which are idempotent. - Drop requires on ldconfig which are already auto-discovered. - Do not ignore errors from useradd/groupadd.- Remove python2 build dependency from samba-libs; (bsc#1116900);- Update update-apparmor-samba-profile script to ignore the shares's paths containing substitution variables in any place, not only at the beginning of the path.- Update to samba-4.9.3 + CVE-2018-14629: Unprivileged adding of CNAME record causing loop in AD Internal DNS server; (bso#13600); (bsc#1116319); + CVE-2018-16841: Double-free in Samba AD DC KDC with PKINIT; (bso#13628); (bsc#1116320); + CVE-2018-16851: NULL pointer de-reference in Samba AD DC LDAP server; (bso#13674); (bsc#1116322); + CVE-2018-16852: NULL pointer de-reference in Samba AD DC DNS servers; (bso#13669); (bsc#1116321); + CVE-2018-16853: Samba AD DC S4U2Self crash in experimental MIT Kerberos configuration (unsupported); (bso#13678); (bsc#1116324); + CVE-2018-16857: Bad password count in AD DC not always effective; window; (bso#13683); (bsc#1116323);- Update to samba-4.9.2 + dsdb: Add comments explaining the limitations of our current backlink behaviour; (bso#13418); + Fix problems running domain backups (handling SMBv2, sites); (bso#13621); + testparm: Fix crashes with PANIC: Messaging not initialized on SLES 12 SP3; (bso#13465); + Make vfs_fruit able to cleanup AppleDouble files; (bso#13642); + File saving issues with vfs_fruit on samba >= 4.8.5; (bso#13646); + Enabling vfs_fruit looses FinderInfo; (bso#13649); + Cancelling of SMB2 aio reads and writes returns wrong error NT_STATUS_INTERNAL_ERROR; (bso#13667); + Fix CTDB recovery record resurrection from inactive nodes and simplify vacuuming; (bso#13641); + examples: Fix the smb2mount build; (bso#13465); + libtevent: Fix build due to missing open_memstream on Illiumos; (bso#13629); + winbindd_cache: Fix timeout calculation for sid<->name cache; (bso#13662); + dsdb encrypted_secrets: Allow "ldb:// and "mdb://" in file path; (bso#13653); + Extended DN SID component missing for member after switching group membership; (bso#13418); + Return STATUS_SESSION_EXPIRED error encrypted, if the request was encrypted; (bso#13624); + python: Allow forced signing via smb.SMB(); (bso#13621); + lib:socket: If returning early, set ifaces; (bso#13665); + ldb: Bump ldb version to 1.4.3, Python: Ensure ldb.Dn can accept utf8 encoded unicode; (bso#13616); + smbd: Fix DELETE_ON_CLOSE behaviour on files with READ_ONLY attribute; (bso#13673); + waf: Add -fstack-clash-protection; (bso#13601); + winbind: Fix segfault if an invalid passdb backend is configured; (bso#13668); + Fix bugs in CTDB event handling; (bso#13659); + Misbehaving nodes are sometimes not banned; (bso#13670);- lib:socket: If returning early, set ifaces; (bso#13665); (bsc#1111373);- winbind requires latest version of libtevent-util0 to start- Backport latest gpo code from master + Read policy from local gpt cache + Offline policy application + Make group policy extensible via register/unregister gpext + gpext's run via a process_group_policy method- Enable profiling data collection- Change samba-kdc package name to samba-ad-dc - Move samba-ad-dc.service to the samba-ad-dc package- Update to samba-4.9.1 + s3: nmbd: Stop nmbd network announce storm; (bso#13620); + s3-rpcclient: Use spoolss_init_spoolss_UserLevel1 in winspool cmds; (bso#13597); + CTDB recovery lock has some race conditions; (bso#13617); + s3-rpc_client: Advertise Windows 7 client info; (bso#13597); + ctdb-doc: Remove PIDFILE option from ctdbd_wrapper man page; (bso#13610);- Tumbleweed doesn't define the sle_version macro, so we must include a check for suse_version also. Otherwise python3 is disabled on Tumbleweed.- Update to samba-4.9.0 + samba_dnsupdate: Honor 'dns zone scavenging' option, only update if needed; (bso#13605); + wafsamba: Fix 'make -j'; (bso#13606);- Update to samba-4.9.0rc5 + s3: VFS: vfs_full_audit: Ensure smb_fname_str_do_log() only returns absolute pathnames; (bso#13565); + s3: util: Do not take over stderr when there is no log file; (bso#13578); + Durable Reconnect fails because cookie.allow_reconnect is not set; (bso#13549); + krb5-samba: Interdomain trust uses different salt principal; (bso#13539); + vfs_fruit: Don't unlink the main file; (bso#13441); + smbd: Fix a memleak in async search ask sharemode; (bso#13602); + Fix Samba GPO issue when Trust is enabled; (bso#11517); + samba-tool: Add "virtualKerberosSalt" attribute to 'user getpassword/syncpasswords'; (bso#13539); + Fix CTDB configuration issues; (bso#13589); + ctdbd logs an error until it can successfully connect to eventd; (bso#13592);- Update to samba-4.9.0rc4 + s3: smbd: Ensure get_real_filename() copes with empty pathnames; (bso#13585); + samba domain backup online/rename commands force user to specify password on CLI; (bso#13566); + wafsamba/samba_abi: Always hide ABI symbols which must be local; (bso#13579); + Fix a panic if fruit_access_check detects a locking conflict; (bso#13584); + Fix memory and resource leaks; (bso#13567); + python: Fix print in dns_invalid.py; (bso#13580); + Aliasing issue causes incorrect IPv6 checksum; (bso#13588); + Fix CTDB configuration issues; (bso#13589); + s3: vfs: time_audit: fix handling of token_blob in smb_time_audit_offload_read_recv(); (bso#13568);- Add missing zlib-devel dependency which was previously pulled in by libopenssl-devel- Update to samba-4.9.0rc3+git.22.3fff23ae36e + CVE-2018-10858: libsmb: Harden smbc_readdir_internal() against returns from malicious servers; (bso#13453); + CVE-2018-1140: ldbsearch '(distinguishedName=abc)' and DNS query with escapes crashes, ldb: Release LDB 1.3.5 for CVE-2018-1140; (bso#13374); + CVE-2018-10918: cracknames: Fix DoS (NULL pointer de-ref) when not servicePrincipalName is set on a user; (bso#13552); + CVE-2018-10919: acl_read: Fix unauthorized attribute access via searches; (bso#13434); + ctdb_mutex_ceph_rados_helper: Set SIGINT signal handler; (bso#13540); + CVE-2018-1139 libcli/auth: Do not allow ntlmv1 over SMB1 when it is disabled via "ntlm auth"; (bso#13360); + s3-tldap: do not install test_tldap; (bso#13529); + ctdb_mutex_ceph_rados_helper: Fix deadlock via lock renewals; (bso#13540); + CVE-2018-1140 Add NULL check for ldb_dn_get_casefold() in ltdb_index_dn_attr(); (bso#13374); + ctdb-eventd: Fix CID 1438155; (bso#13554); + Fix CIDs 1438243, (Unchecked return value) 1438244 (Unsigned compared against 0), 1438245 (Dereference before null check) and 1438246 (Unchecked return value); (bso#13553); + ctdb: Fix a cut&paste error; (bso#13554); + systemd: Only start smb when network interfaces are up; (bso#13559); + Fix quotas don't work with SMB2; (bso#13553); + s3/smbd: Ensure quota code is only called when quota support detected; (bso#13563); + s3/libsmb: Explicitly set delete_on_close token for rmdir; (bso#13204); + s3:waf: Install eventlogadm to /usr/sbin; (bso#13561); + Shorten description in vfs_linux_xfs_sgid manual; (bso#13562);- Update to samba-4.9.0rc2+git.21.a1069afb007 + s3: smbd: Using "sendfile = yes" with SMB2 can cause CPU spin; (bso#13537); + s3: smbd: Fix path check in smbd_smb2_create_durable_lease_check(); (bso#13535); + samba-tool trust: Support discovery via netr_GetDcName; (bso#13538); + s4-dsdb: Only build dsdb Python modules for AD DC; (bso#13542); + Fix portability issues on freebsd; (bso#13520); + DNS wildcard search does not handle multiple labels correctly; (bso#13536); + samba-tool domain trust: Fix trust compatibility to Windows Server 1709 and FreeIPA; (bso#13308); + Fix portability issues on freebsd; (bso#13520); + ctdb-protocol: Fix CTDB compilation issues; (bso#13545); + ctdb-docs: Replace obsolete reference to CTDB_DEBUG_HUNG_SCRIPT option; (bso#13546); + ctdb-doc: Provide an example script for migrating old configuration; (bso#13550); + ctdb-event: Implement event tool "script list" command; (bso#13551);- Update to samba-4.8.4+git.37.a7a861d7982; + CVE-2018-1139: Weak authentication protocol allowed; (bsc#1095048); (bsc#13360); + CVE-2018-1140: Denial of Service Attack on DNS and LDAP server; (bsc#1095056); (bso#13466); (bso#13374); + CVE-2018-10858: Insufficient input validation on client directory listing in libsmbclient; (bsc#1103411); (bso#13453); + CVE-2018-10918: Denial of Service Attack on AD DC DRSUAPI server; (bsc#1103414); (bso#13552); + CVE-2018-10919: Confidential attribute disclosure from the AD LDAP server; (bsc#1095057); (bso#13434); + s3:winbind: winbind normalize names' doesn't work for users; (bso#12851); + winbind: Fix UPN handling in canonicalize_username(); (bso#13369); + s3: smbd: Fix SMB2-FLUSH against directories; (bso#13428); + samdb: Fix building Samba with gcc 8.1; (bso#13437); + s3:utils: Do not segfault on error in DoDNSUpdate(); (bso#13440); + smbd: Flush dfree memcache on service reload; (bso#13446); + ldb: Save a copy of the index result before calling the + lib/util: No Backtrace given by Samba's AD DC by default; (bso#13454). + s3: smbd: printing: Re-implement delete-on-close semantics for print files missing since 3.5.x; (bso#13457). + python: Fix talloc frame use in make_simple_acl(); (bso#13474). + krb5_wrap: Fix keep_old_entries logic for older Kerberos libraries;(bso#13478). + krb5_plugin: Add winbind localauth plugin for MIT Kerberos; (bso#13480).- Add missing package descriptions; (bsc#1093864); - Fix dependency issue between samba-python and samba-kdc; (bsc#1062876); - Call update-apparmor-samba-profile when running samba-ad-dc; (bsc#1092099);- Update to 4.8.2 + After update to 4.8.0 DC failed with "Failed to find our own NTDS Settings objectGUID" (bso#13335). + fix incorrect reporting of stream dos attributes on a directory (bso#13380). + vfs_ceph: add asynchronous fsync; fake synchronous call (bso#13412). + vfs_ceph: add fake async pwrite/pread send/recv hooks; (bso#13425) + vfs_ceph: Fix memory leak; (bso#13424). + libsmbclient: Fix hard-coded connection error return of ETIMEDOUT; (bso#13419). + s4-lsa: Fix use-after-free in LSA server; (bso#13420). + winbindd: Do re-connect if the RPC call fails in the passdb case; (bso#13430). + cleanupd: Sends MSG_SMB_UNLOCK twice to interested peers; (bso#13416). + cleanupd: Use MSG_SMB_BRL_VALIDATE to signal cleanupd unclean process shutdown; (bso#13414). + ctdb-client: Remove ununsed functions from old client code; (bso#13411). + printing: Return the same error code as windows does on upload failures; (bso#13395). + nsswitch: Fix memory leak in winbind_open_pipe_sock() when the privileged pipe is not accessable; (bso#13400). + s4:lsa_lookup: remove TALLOC_FREE(state) after all dcesrv_lsa_Lookup{Names,Sids}_base_map() calls; (bso#13420). + rpc_server: Fix NetSessEnum with stale sessions; (bso#13407). + s3:smbspool: Fix cmdline argument handling; (bso#13417).- Move libdfs-server-ad-samba4.so library from kdc to libs package, as it is required by some client libs; (bsc#1074135); - Update to 4.8.1; (bsc#1091179); + s3: ldap: Ensure the ADS_STRUCT pointer doesn't get freed on error, we don't own it here; (bso#13244); + s3: smbd: Fix possible directory fd leak if the underlying OS doesn't support fdopendir(); (bso#13270); + Round-tripping ACL get/set through vfs_fruit will increase the number of ACE entries without limit; (bso#13319); + s3: smbd: SMB2: Add DBGC_SMB2_CREDITS class to specifically debug credit issues; (bso#13347); + s3: smbd: Files or directories can't be opened DELETE_ON_CLOSE without delete access; (bso#13358); + s3: smbd: Fix memory leak in vfswrap_getwd(); (bso#13372); + s3: smbd: Unix extensions attempts to change wrong field in fchown call; (bso#13375); + ms_schema/samba-tool visualize: Fix python2.6 incompatibility; (bso#13337); + Fix invocation of gnutls_aead_cipher_encrypt(); (bso#13352); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + winbindd: Recover loss of netlogon secure channel in case the peer DC is rebooted; (bso#13332); + s3:smbd: Don't use the directory cache for SMB2/3; (bso#13363); + ctdb-client: Fix bugs in client code; (bso#13356); + ctdb-scripts: Drop "net serverid wipe" from 50.samba event script; (bso#13359); + s3: lib: messages: Don't use the result of sec_init() before calling sec_init(); (bso#13368); + libads: Fix the build '--without-ads'; (bso#13273); + winbind: Keep "force_reauth" in invalidate_cm_connection, add 'smbcontrol disconnect-dc'; (bso#13332); + vfs_virusfilter: Fix CIDs 1428738-1428740; (bso#13343); + dsdb: Fix CID 1034966 Uninitialized scalar variable; (bso#13367); + rpc_server: Fix core dump in dfsgetinfo; (bso#13370); + smbclient: Fix notify; (bso#13382); + Fix smbd panic if the client-supplied channel sequence number wraps; (bso#13215); + Windows 10 cannot logon on Samba NT4 domain; (bso#13328); + lib/util: Remove unused '#include ' from tests/tfork.c; (bso#13342); + Fix build errors with cc from developerstudio 12.5 on Solaris; (bso#13343); + Fix the picky-developer build on FreeBSD 11; (bso#13344); + s3:modules: Fix the build of vfs_aixacl2.c; (bso#13345); + s3:smbd: map nterror on smb2_flush errorpath; (bso#13338); + lib:replace: Fix linking when libtirpc-devel overwrites system headers; (bso#13341); + winbindd: 'wbinfo --name-to-sid' returns misleading result on invalid query; (bso#13312); + s3:passdb: Do not return OK if we don't have pinfo set up; (bso#13376); + Allow AESNI to be used on all processor supporting AESNI; (bso#13302);- Use new foreground execution flags for systemd samba daemons; (bsc#1088574); (bsc#1071090); (bsc#1065551); + Add %post scriptlet to clear old sysconfig flags - Update vendor-files to commit 880b3e7. + Set samba sysconfig template variables to "" + Add required daemon flags directly to systemd unit- Specfile cleanup + Remove %if..%endif guards which don't affect the build + Remove redundant %clean section + Replace old $RPM_* shell vars with macros- BuildRequire pkgconfig(systemd) and pkgconfig(libsystemd) in place of systemd and systemd-devel: Allow OBS to optimize the workload by allowing the usage of the 'build-optimized' systemd packages.- Enable building samba with python3, and create a samba-python3 package.- Update to 4.8 + New GUID Index mode in sam.ldb for the AD DC + GPO support for samba KDC + Time machine support with vfs_fruit + Encrypted secrets + AD Replication visualization + Improved trust support - ability to not scan global trust list - AD external trusts have limited support - verbose trusted domain listing + VirusFilter VFS module + NT4-style replication removed + vfs_aio_linux removed- Disable samba-pidl package, due to the removal of dependency perl-Parse-Yapp; (bsc#1085150);- Update to 4.7.6; + CVE-2018-1050: DOS vulnerability when SPOOLSS is run externally; (bso#11343); (bsc#1081741); + CVE-2018-1057: Authenticated users can change other users' password; (bso#13272); (bsc#1081024).- Disable python until full python3 port is done; (bsc#1082139); + Remove contents of package samba-python + Remove contents of package libsamba-policy0 + Remove contents of package libsamba-policy-devel + Remove library libsamba-python-samba4.so from samba-libs package + Remove library libsamba-net-samba4.so from samba-libs package + Remove smbtorture binary and manpage from samba-test- samba fails to build with glibc2.27; (bsc#1081042);- Update to 4.7.5; (bsc#1080545); + smbd tries to release not leased oplock during oplock II downgrade; (bso#13193); + Fix copying file with empty FinderInfo from Windows client to Samba share with fruit; (bso#13181); + build: Deal with recent glibc sunrpc header removal; (bso#10976); + Make Samba work with tirpc and libnsl2; (bso#13238); + vfs_ceph: Add fs_capabilities hook to avoid local statvfs; (bso#13208); (bsc#1075206); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + ctdb-recovery-helper: Deregister message handler in error paths; (bso#13188); + samba: Only use async signal-safe functions in signal handler; (bso#13240); + Kerberos: PKINIT: Can't decode algorithm parameters in clientPublicValue; (bso#12986); + repl_meta_data: Fix linked attribute corruption on databases with unsorted links on expunge. dbcheck: Add functionality to fix the corrupt database; (bso#13228); + Fix smbd panic when chdir returns error during exit; (bso#13189); + Make Samba work with tirpc and libnsl2; (bso#13238); + Fix POSIX ACL support on HPUX and possibly other big-endian OSs; (bso#13176);- Update to 4.7.4; (bsc#1080545); + s3: smbclient: Implement 'volume' command over SMB2; (bso#13140); + s3: libsmb: Fix valgrind read-after-free error in cli_smb2_close_fnum_recv(); (bso#13171); + s3: libsmb: Fix reversing of oldname/newname paths when creating a reparse point symlink on Windows from smbclient; (bso#13172); + Build man page for vfs_zfsacl.8 with Samba; (bso#12934); + repl_meta_data: Allow delete of an object with dangling backlinks; (bso#13095); + s4:samba: Fix default to be running samba as a deamon; (bso#13129); + Performance regression in DNS server with introduction of DNS wildcard, ldb: Release 1.2.3; (bso#13191); + vfs_zfsacl: Fix compilation error; (bso#6133); + "smb encrypt" setting changes are not fully applied until full smbd restart; (bso#13051); + winbindd: Fix idmap_rid dependency on trusted domain list; (bso#13052); + vfs_fruit: Proper VFS-stackable conversion of FinderInfo; (bso#13155); + winbindd: Dependency on trusted-domain list in winbindd in critical auth codepath; (bso#13173); + repl_meta_data: Fix removing of backlink on deleted objects; (bso#13120); + ctdb: sock_daemon leaks memory; (bso#13153); + TCP tickles not getting synchronised on CTDB restart; (bso#13154); + winbindd: winbind parent and child share a ctdb connection; (bso#13150); + pthreadpool: Fix deadlock; (bso#13170); + pthreadpool: Fix starvation after fork; (bso#13179); + messaging: Always register the unique id; (bso#13180); + s4/smbd: set the process group; (bso#13129); + Fix broken linked attribute handling; (bso#13095); + The KDC on an RWDC doesn't send error replies in some situations; (bso#13132); + libnet_join: Fix 'net rpc oldjoin'; (bso#13149); + g_lock conflict detection broken when processing stale entries; (bso#13195); + s3:smb2_server: allow logoff, close, unlock, cancel and echo on expired sessions; (bso#13197); + s3:libads: net ads keytab list fails with "Key table name malformed"; (bso#13166); (bsc#1067700); + Fix crash in pthreadpool thread after failure from pthread_create; (bso#13170); + s4:samba: Allow samba daemon to run in foreground; (bso#13129); (bsc#1065551); + third_party: Link the aesni-intel library with "-z noexecstack"; (bso#13174); + vfs_glusterfs: include glusterfs/api/glfs.h without relying on "-I" options; (bso#13125);- Re-enable usage of libnsl (did got lost with glibc change) - Use TI-RPC (sunrpc is deprecated and will be removed soon from glibc)- smbc_opendir should not return EEXIST with invalid login credentials; (bnc#1065868).- Update to 4.7.3; (bsc#1069666); + Non-smbd processes using kernel oplocks can hang smbd; (bso#13121); + python: use communicate to fix Popen deadlock; (bso#13127); + smbd on disk file corruption bug under heavy threaded load; (bso#13130); + tevent: version 0.9.34; (bso#13130); + s3: smbd: Fix delete-on-close after smb2_find; (bso#13118); + CVE-2017-14746: s3: smbd: Fix SMB1 use-after-free crash bug; (bsc#1060427);(bso#13041); + CVE-2017-15275: s3: smbd: Chain code can return uninitialized memory when talloc buffer is grown; (bsc#1063008); (bso#13077); - Build with AD DC support only in openSUSE.- Replace references to /var/adm/fillup-templates with new %_fillupdir macro (boo#1069468)- samba-tool requires samba-python; (bnc#1067771).- Run all daemons in the foreground and let systemd handle it; (bsc#1065551). - Update to 4.7.1; + Fix exporting subdirs with shadow_copy2; (bso#13091); + Currently if getwd() fails after a chdir(), we panic; (bso#13027); + Ensure default SMB_VFS_GETWD() call can't return a partially completed struct smb_filename; (bso#13068); + sys_getwd() can leak memory or possibly return the wrong errno on older systems; (bso#13069); + smbclient doesn't correctly canonicalize all local names before use; (bso#13093); + Fix broken linked attribute handling; (bso#13095); + Missing LDAP query escapes in DNS rpc server; (bso#12994); + Link to -lbsd when building replace.c by hand; (bso#13087); + Cannot delete non-ACL files on Solaris/ZFS/NFSv4 ACL filesystem; (bso#6133); + Map SYNCHRONIZE acl permission statically in zfs_acl vfs module; (bso#7909); + Samba fails to honor SEC_STD_WRITE_OWNER bit with the acl_xattr module; (bso#7933); + Missing assignment in sl_pack_float; (bso#12991); + Wrong Samba access checks when changing DOS attributes; (bso#12995); + samba_runcmd_send() leaves zombie processes on timeout; (bso#13062); + groupmap cleanup should not delete BUILTIN mappings; (bso#13065); + Enabling vfs_fruit results in loss of Finder tags and other xattrs; (bso#13076); + man pages: Properly ident lists; (bso#9613); + smb.conf.5: Sort parameters alphabetically; (bso#13081); + Fix GUID string format on GetPrinter info; (bso#12993); + Remote serverid check doesn't check for the unique id; (bso#13042); + CTDB starts consuming memory if there are dead nodes in the cluster; (bso#13056); + ctdb-common: Ignore event scripts with multiple '.'s; (bso#13070); + libgpo doesn't sort the GPOs in the correct order; (bso#13046); + Remote serverid check doesn't check for the unique id; (bso#13042); + vfs_catia: Fix a potential memleak; (bso#13090); + Fix file change notification for renames; (bso#12903); + Samba DNS server does not honour wildcards; (bso#12952); + Can't change password in samba from a Windows client if Samba runs on IPv6 only interface; (bso#13079); + vfs_fruit: Replace closedir() by SMB_VFS_CLOSEDIR; (bso#13086); + Apple client can't cope with SMB2 async replies when creating symlinks; (bso#13047); + s4:rpc_server:backupkey: Move variable into scope; (bso#12959); + Fix ntstatus_gen.h generation on 32bit; (bso#13099); + Fix a double free in vfs_gluster_getwd(); (bso#13100); + Fix resouce leaks and pointer issues; (bso#13101); + vfs_solarisacl: Fix build for samba 4.7 and up; (bso#13049);- Add samba-kdc to baselibs.conf. - Do not wrap samba-kdc's package definition into if/endif: the package won't be generated simply based on the fact that there is no files section for the package. Allows the source validator to ensure samba-kdc is a built package.- Update to 4.7.0; + Whole DB read locks: Improved LDAP and replication consistency; (bso#12858). + Samba AD with MIT Kerberos + Dynamic RPC port range: Default range changed from "1024-1300" to "49152-65535". + Authentication and Authorization audit support: New auth_audit debug class. + Multi-process LDAP Server: The LDAP server in the AD DC now honours the process model used for the rest of the 'samba' process. + Improved Read-Only Domain Controller (RODC) Support; (bso#12977). + Additional password hashes stored in supplementalCredentials. + Improvements to DNS during Active Directory domain join. + Significant AD performance and replication improvements. + Query record for open file or directory. + Removal of lpcfg_register_defaults_hook(). + Change of loadable module interface. + SHA256 LDAPS Certificates: The self-signed certificate generated for use on LDAPS will now be generated with a SHA256 self-signature, not a SHA1 self-signature. + CTDB no longer allows mixed minor versions in a cluster. + CTDB now ignores hints from Samba about TDB flags when attaching to databases. + New configuration variable CTDB_NFS_CHECKS_DIR. + The CTDB_SERVICE_AUTOSTARTSTOP configuration has been removed. + The CTDB_SCRIPT_DEBUGLEVEL configuration variable has been removed. + The example NFS Ganesha call-out has been improved. + A new "replicated" database type is available.- CVE-2017-12163: Prevent client short SMB1 write from writing server memory to file; (bso#13020); (bsc#1058624).- CVE-2017-12150: Some code path don't enforce smb signing, when they should; (bso#12997); (bsc#1058622).- CVE-2017-12151: Keep required encryption across SMB3 dfs redirects; (bso#12996); (bsc#1058565).- Clean specfile assuming SUSE-only system and product >=SLE11 + %{ul_version}, %{rhel_version}, %{mandriva_version}, %{centos_version} are always undefined + %{_vendor} is "suse" and %{suse_version} is at least 1100- Update to 4.6.7; (bsc#1054017) + Joining a Huawai storage fails: empty CLDAP ping answer; (bso#11392). + smbcacls can fail against a directory on Windows using SMB2.; (bso#12937). + vfs_ceph provides inconsistent directory listings; (bso#12911). + Misused talloc context can cause a user to crash their smbd by chaining SMB1 commands.; (bso#12836). + Use-after free can crash libsmbclient code.; (bso#12927). + Server exit with active AIO can crash.; (bso#12925). + Ensure notifyd doesn't return from smbd_notifyd_init; (bso#12910). + fd leak to ctdb sub-processes leads to SELinux AVC denial in audit logs; (bso#12898). + vfs_fruit shouldn't send MS NFS ACEs to Windows clients; (bso#12897). + smbspool_krb5_wrapper does not tell CUPS that it requires negotiate for authentication; (bso#12886). + finder sidebar showing question mark instead of icon when using ip to connect with vfs_fruit; (bso#12840). + Winbind stops obtaining the 'unixHomeDirectory' & 'loginShell' attributes from AD.; (bso#12720). + KCC run at selftest startup can fail spuriously due to a race; (bso#12869). + winbindd changes the local password and gets NT_STATUS_WRONG_PASSWORD for the remote change; (bso#12782). + rpc_pipe_client memory leaks due to long term memory context passed to rpc_pipe_open_interface(); (bso#12890). + CVE-2017-2619 breaks accessing previous versions of directories with snapshots in subdirectories of the share; (bso#12885). + dns_name_equal doing OOB read; (bso#12813). + replica_sync tests flap; (bso#12753). + Selftest should not call 'net cache flush' and wipe important winbind entries; (bso#12868). + Old Samba versions don't support using recent ldb versions (>=1.1.30); (bso#12859). + pam_winbind fails with kerberos method = secrets and keytab; (bso#10490). + race starting winbindd against posixacl test; (bso#12843). + Crash in the reentrant smbd_smb2_create_send() if the something fails in the subsequent try; (bso#12832). + spnego.c passes the wrong argument order to gensec_update_ev() for the FALLBACK case; (bso#12788). + Clients with SMB3 support can't connect with "server max protocol = SMB2_02"; (bso#12772). + A log message of samb-tool user syncpasswords reverses string arguments in a debug message "Call Popen[...".; (bso#12768). + The smb tarmode tests kills the share dir contents; (bso#12867). + Fix for a bug in MacOS X Sierra NTLMv2 processing; (bso#12862). + CVE-2017-2619 regression with non-wide symlinks to directories; (bso#12860). + manpage/index.html lists links not in alphabetical order; (bso#12854). + smbcacls got error NT_STATUS_NETWORK_NAME_DELETED; (bso#12831). + If a record is locked in a database, then recovery does not complete; (bso#12857). + debug_locks.sh script does not log any information; (bso#12856). + SIGSEGV in cm_connect_lsa_tcp dereferencing conn->lsa_tcp_pipe->transport after error; (bso#12852). + smbclient can't parse DOMAIN+username if a different winbind separator is used; (bso#12849). + Related requests with SessionSetup fail with INTERNAL_ERROR; (bso#12845). + Related requests with TreeConnect fail with NETWORK_NAME_DELETED; (bso#12844). + cli->server_os not filled correctly; (bso#12779). + REGRESSION: smbclient doesn't print the session setup anymore; (bso#12824). + smblcient doesn't handle STATUS_NOT_SUPPORTED gracefully for FSCTL_VALIDATE_NEGOTIATE_INFO; (bso#12808). + CTDB NFS call-out failures do not cause event failures; (bso#12837). + net command fails due to incorrectly return code; (bso#12828). + Fix building Samba with GCC 7.1; (bso#12827).- Fix duplicate CTDB_LOGGING params when downgraded and upgraded again; (bsc#1048339).- fix cephwrap_chdir(); (bsc#1048790). - Update to 4.6.6 + CVE-2017-11103: Orpheus' Lyre KDC-REP service name validation; (bsc#1048278).- Fix ctdb logs to /var/log/log.ctdb instead of /var/log/ctdb; (bsc#1048339).- Fix inconsistent ctdb socket path; (bsc#1048352). - Fix non-admin cephx authentication; (bsc#1048387).- Update to 4.6.5; (bsc#1040157) + Specifying CTDB_LOGGING=syslog:nonblocking causes ctdbd to crash at startup; (bso#12814). + vfs_expand_msdfs tries to open the remote address as a file path; (bso#12687). + PANIC (pid 1096): assert failed: lease_type_is_exclusive(e_lease_type); (bso#12798). + With clustering get update_num_read_oplocks failed and PANIC: num_share_modes == 1 assertion failure; (bso#11844). + contend_level2_oplocks_begin_default oplock optimisation doesn't carry over to leases; (bso#12766). + `ctdb nodestatus` incorrectly displays status for all nodes with wrong exit code; (bso#12802). + CTDB can spin hard on revoking readonly delegations if a node becomes disconnected; (bso#12697). + Printing a share mode entry with leases can crash in the ndr code; (bso#12793). + Fix flakey unit tests for eventd; (bso#12792). + CTDB daemon crashes if built with clang; (bso#12770). + smbcacls fails if no password is specified; (bso#12765). + idmap_rfc2307: Lookup of more than two SIDs fails; (bso#12757). + samba-tool user syncpasswords doesn't trigger the script when a user gets removed; (bso#12767). + systemd: fix detection of libsystemd; (bso#12764). + Notify subsystem only maps first inotify mask to Windows notify filter; (bso#12760). + Allow passing trusted domain password as plain-text to PASSDB layer; (bso#12751). + Can't case-rename files with vfs_fruit; (bso#12749). + wrong sid->uid mapping for SIDs residing in sIDHistory; (bso#12702). + vfs_acl_common should force "create mask = 0777", not 0666; (bso#12562). + Ordering of notify responses broken; (bso#12756).- s3: libsmb: Fix error where short name length was read as 2 bytes, should be 1; (bso#11822); (bsc#1042419).- Revert explicit winbind %{version}-%{release} dependency. + The ABI has stabilized since (bsc#936909), so remove to fix cross-media dependencies; (bsc#1037899).- Fix CVE-2017-7494 remote code execution from a writable share; (bso#12780); (bsc#1038231).- Update to 4.6.3; (bsc#1036011) + s3:vfs:shadow_copy2: vfs_shadow_copy2 fails to list snapshots from shares with GlusterFS backend; (bso#12743). + Fix for Solaris C compiler; (bso#12559). + s3: locking: Update oplock optimization for the leases era; (bso#12628). + Make the Solaris C compiler happy; (bso#12693). + s3: libgpo: Allow skipping GPO objects that don't have the expected LDAP attributes; (bso#12695). + Fix buffer overflow caused by wrong use of getgroups; (bso#12747). + lib: debug: Avoid negative array access; (bso#12746). + cleanupdb: Fix a memory read error; (bso#12748). + streams_xattr and kernel oplocks results in NT_STATUS_NETWORK_BUSY; (bso#7537). + winbindd: idmap_autorid allocates ids for unknown SIDs from other backends; (bso#11961). + vfs_fruit: Resource fork open request with flags=O_CREAT|O_RDONLY; (bso#12565). + manpages/vfs_fruit: Document global options; (bso#12615). + lib/pthreadpool: Fix a memory leak; (bso#12624). + Lookup-domain for well-known SIDs on a DC; (bso#12727). + winbindd: Fix error handling in rpc_lookup_sids(); (bso#12728). + winbindd: Trigger possible passdb_dsdb initialisation; (bso#12729). + credentials_krb5: use gss_acquire_cred for client-side GSSAPI use case; (bso#12611). + lib/crypto: Implement samba.crypto Python module for RC4; (bso#12690). + ctdb-readonly: Avoid a tight loop waiting for revoke to complete; (bso#12697). + ctdb_event monitor command crashes if event is not specified; (bso#12723). + ctdb-docs: Fix documentation of "-n" option to 'ctdb tool'; (bso#12733). + smbd: Fix smb1 findfirst with DFS; (bso#12558). + smbd: Do an early exit on negprot failure; (bso#12610). + winbindd: Fix substitution for 'template homedir'; (bso#12699). + s4:kdc: Disable principal based autodetected referral detection; (bso#12554). + idmap_autorid: Allocate new domain range if the callers knows the sid is valid; (bso#12613). + LINKFLAGS_PYEMBED should not contain -L/some/path; (bso#12724). + PAM auth with WBFLAG_PAM_GET_PWD_POLICY returns wrong policy for trusted domain; (bso#12725). + rpcclient: Allow -U'OTHERDOMAIN\user' again; (bso#12731). + winbindd: Fix password policy for pam authentication; (bso#12725). + s3:gse: Correctly handle external trusts with MIT; (bso#12554). + auth/credentials: Always set the realm if we set the principal from the ccache; (bso#12611). + replace: Include sysmacros.h; (bso#12686). + s3:vfs_expand_msdfs: Do not open the remote address as a file; (bso#12687). + s3:libsmb: Only print error message if kerberos use is forced; (bso#12704). + winbindd: Child process crashes when kerberos-authenticating a user with wrong password; (bso#12708). + vfs_fruit: Office document opens as read-only on macOS due to CNID semantics; (bso#12715). + vfs_acl_xattr: Fix failure to get ACL on Linux if memory is fragmented; (bso#12737).- Generate and update vendor-files tarball from Git + SuSEfirewall2 service samba-client only setup IPv4 rule; (bsc#1034416).- Generate source tarball directly from Git using OBS tar_scm + use version string derived from parent Git tag and commit hash - remove obsolete vendor-files/tools/package-data version ID + explicitly generate ctdb manpages, needed without "make dist"- Update to 4.6.2 + remove bso#12721 patches now upstream- Enable samba-ceph build for openSUSE and SLE12SP3+; (fate#321622). + x86-64 and aarch64- Enable librados CTDB lock helper for samba-ceph package; (fate#321622).- Build and install the html man pages (bsc#1021907).- Fix CVE-2017-2619 regression with "follow symlinks = no"; (bso#12721).- Update to 4.6.1 + symlink race permits opening files outside share directory; CVE-2017-2619; (bso#12496); (bsc#1027147) + testparm checks for valid idmap parameters + add new krb client encryption types + support for printer driver upload from windows 10 + inherit owner = 'unix only' for improved quota support + improved CTDB event support + new primary group support for idmap_ad + idmap_hash deprecated + mvxattr added to recursively rename extended attributes- Remove chkconfig requirements for systemd systems- Don't call insserv if systemd is used- Fix check if we need to require insserv- async_req: make async_connect_send() "reentrant"; (bso#12105); (bsc#1024416).- Force usage of ncurses6-config thru NCURSES_CONFIG env var; (bsc#1023847).- add missing patch for libnss_wins segfault; (bsc#995730).- Fix vfs_ceph builds against recent Ceph versions; (bsc#1021933).- Document "winbind: ignore domains" parameter; (bsc#1019416).- Add base Samba dependency to samba-ceph package.- Update to 4.5.3 + Heap-based Buffer Overflow Remote Code Execution Vulnerability; CVE-2016-2123; (bso#12409); (bsc#1014437). + Don't send delegated credentials to all servers; CVE-2016-2125; (bso#12445); (bsc#1014441). + denial of service due to a client triggered crash in the winbindd parent process; CVE-2016-2126; (bso#12446); (bsc#1014442). - 4.5.1 and 4.5.2 updates + various streams vfs fixes + various printing fixes + ntlm_auth: do not map explicitly empty domain + various stability fixes in smbd + match file compression ReFS behavior- Add missing ldb module directory; (bnc#1012092).- s3/client: obey 'disable netbios' smb.conf param, don't connect via NBT port; (bsc#1009085); (bso#12418).- Include vfstest in samba-test; (bsc#1001203).- s3/winbindd: using default domain with user@domain.com format fails; (bsc#997833).- Fix segfault in libnss_wins; (bso#12277); (bso#12269); (bsc#995730).- Update to 4.5.0 + NTLM1 Authentication disabled by default + SMB2.1 leases enabled by default + Support for OFD locks + ctdb tool rewritten + Added shadow copy snapshot prefix parameter- Fix illegal memory access after memory has been deleted; (bso#11836); (bsc#975299).- Prevent core, make sure response->extra_data.data is always cleared out; (bsc#993692).- Don't package man pages for VFS modules that aren't built; (boo#993707).- Fix population of ctdb sysconfig after source merge; (bsc#981566).- Enable vfs_ceph builds for Factory (x86-64) + Package as samba-ceph to avoid Ceph dependency in base package.- Update to 4.4.5 + Prevent client-side SMB2 signing downgrade; CVE-2016-2119; (bso#11860); (bsc#986869).- Remove obsolete syslog.target; (bsc#983938).- Honor smb.conf socket options in winbind; (bsc#975131).- Don't use htons() with IP_PROTO_RAW; (bso#11705); (bsc#969522).- Update to 4.4.4 + SMB3 multichannel: Add implementation of missing channel sequence number verification; (bso#11809). + smbd:close: Only remove kernel share modes if they had been taken at open; (bso#11919). + notifyd: Prevent NULL deref segfault in notifyd_peer_destructor; (bso#11930). + s3:rpcclient: Make '--pw-nt-hash' option work; (bso#10796). + Fix case sensitivity issues over SMB2 or above; (bso#11438). + s3:smbd: Fix anonymous authentication if signing is mandatory. (bso#11910) + Fix NTLM Authentication issue with squid; (bso#11914). + pdb: Fix segfault in pdb_ldap for missing gecos; (bso#11530). + Fix memory leak in share mode locking; (bso#11934).- Update to 4.4.3 + Various post-badlock regressions; (bso#11841); (bso#11850); (bso#11858); (bso#11870); (bso#11872). + Only allow idmap_hash for default idmap config (bso#11786). + smbd: Avoid large reads beyond EOF; (bso#11878). + vfs_acl_common: Avoid setting POSIX ACLs if "ignore system acls" is set; (bso#11806). + libads: Record session expiry for spnego sasl binds; (bso#11852).- Fix NTLMSSP regressions caused by previous CVE fixes; (bso#11849); (bsc#975962); (bsc#979268), (bsc#977669).- Revert shared library packaging to comply with SLPP- Update to 4.4.2 + A man-in-the-middle can downgrade NTLMSSP authentication; CVE-2016-2110; (bso#11688); (bsc#973031). + Domain controller netlogon member computer can be spoofed; CVE-2016-2111; (bso#11749); (bsc#973032). + LDAP conenctions vulnerable to downgrade and MITM attack; CVE-2016-2112; (bso#11644); (bsc#973033). + TLS certificate validation missing; CVE-2016-2113; (bso#11752); (bsc#973034). + Named pipe IPC vulnerable to MITM attacks; CVE-2016-2115; (bso#11756); (bsc#973036). + "Badlock" DCERPC impersonation of authenticated account possible; CVE-2016-2118; (bso#11804); (bsc#971965). + DCERPC server and client vulnerable to DOS and MITM attacks; CVE-2015-5370; (bso#11344); (bsc#936862).- Fix samba.tests.messaging test and prevent potential tdb corruption by removing obsolete now invalid tdb_close call; (bsc#974629).- Obsolete libsmbclient from libsmbclient0 while not providing it; (bsc#972197).- Update to 4.4.0. + Read of uninitialized memory DNS TXT handling; (bso#11128); (bso#11686); CVE-2016-0771. + Getting and setting Windows ACLs on symlinks can change permissions on link target; (bso#11648); CVE-2015-7560. + Sockets with htons(IPPROTO_RAW); (bso#11705); CVE-2015-8543. + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystem with no ACL support; (bso#10489). + docs: Add example for domain logins to smbspool man page; (bso#11643). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + docs: Add smbspool_krb5_wrapper manpage; (bso#11690). + winbindd: Return trust parameters when listing trusts; (bso#11691). + ctdb: Do not provide a useless pkgconfig file for ctdb; (bso#11696). + Crypto.Cipher.ARC4 is not available on some platforms, fallback to M2Crypto.RC4.RC4 then; (bso#11699). + s3:utils/smbget: Set default blocksize; (bso#11700). + Streamline 'smbget' options with the rest of the Samba utils; (bso#11700). + s3:clispnego: Fix confusing warning in spnego_gen_krb5_wrap(); (bso#11702). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + s3:vfs:glusterfs: Fix build after quota changes; (bso#11715). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + lib:socket: Fix CID 1350010: Integer OVERFLOW_BEFORE_WIDEN; (bso#11723). + smbd: Fix CID 1351215 Improper use of negative value; (bso#11724). + smbd: Fix CID 1351216 Dereference null return value; (bso#11725). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + docs: Add manpage for cifsdd; (bso#11730). + param: Fix str_list_v3 to accept ; again; (bso#11732). + lib/socket: Fix improper use of default interface speed; (bso#11734). + lib:socket: Fix CID 1350009: Fix illegal memory accesses (BUFFER_SIZE_WARNING); (bso#11735). + libcli: Fix debug message, print sid string for new_ace trustee; (bso#11738). + Fix installation path of Samba helper binaries; (bso#11739). + Fix memory leak in loadparm; (bso#11740). + tevent: version 0.9.28: Fix memory leak when old signal action restored; (bso#11742). + smbd: Ignore SVHDX create context; (bso#11753). + Fix net join; (bso#11755). + s3:libads: setup the msDS-SupportedEncryptionTypes attribute on ldap_add; (bso#11755). + passdb: Add linefeed to debug message; (bso#11763). + s3:utils/smbget: Fix option parsing; (bso#11767). + libnet: Make Kerberos domain join site-aware; (bso#11769). + Reset TCP Connections during IP failover; (bso#11770). + ldb: Version 1.1.26; (bso#11772). + s3:smbd: Add negprot remote arch detection for OSX; (bso#11773). + vfs_glusterfs: Fix use after free in AIO callback; (bso#11774). + mkdir can return ACCESS_DENIED incorrectly on create race; (bso#11780). + "trustdom_list_done: Got invalid trustdom response" message should be avoided; (bso#11782). + Mismatch between local and remote attribute ids lets replication fail with custom schema; (bso#11783). + Quota is not supported on Solaris 10; (bso#11788). + Talloc: Version 2.1.6; (bso#11789). + smbd: Enable multi-channel if 'server multi channel support = yes' in the config; (bso#11796). + build: Fix build when '--without-quota' specified; (bso#11798). + lib/socket/interfaces: Fix some uninitialied bytes; (bso#11802). + Access based share enum: handle permission set in configuration files; (bso#8093). + See also WHATSNEW.txt from the samba-doc package.- Update to 4.3.6. + Getting and setting Windows ACLs on symlinks can change permissions on link target; CVE-2015-7560; (bso#11648); (bsc#968222). + Fix Out-of-bounds read in internal DNS server; CVE-2016-0771; (bso#11128); (bso#11686); (bsc#968223).- Upgrade on-disk FSRVP server state to new version; (bsc#924519).- Only obsolete but do not provide gplv2/3 package names; (bsc#968973).- Relocate existing lock files to /var/lib/samba/lock; (bsc#968963).- Obsolete no longer existing samba-32bit package; (bsc#967625).- Update to 4.3.5. + s3:utils/smbget: Fix recursive download; (bso#6482). + s3: smbd: posix_acls: Fix check for setting u:g:o entry on a filesystemi with no ACL support; (bso#10489). + s3:smbd/oplock: Obey kernel oplock setting when releasing oplocks; (bso#11400). + vfs_shadow_copy2: Fix case where snapshots are outside the share; (bso#11580). + smbclient: Query disk usage relative to current directory; (bso#11662). + winbindd: Handle expired sessions correctly; (bso#11670). + smbd: Show correct disk size for different quota and dfree block sizes; (bso#11681). + smbcacls: Fix uninitialized variable; (bso#11682). + s3:smbd: Ignore initial allocation size for directory creation; (bso#11684). + s3-client: Add a KRB5 wrapper for smbspool; (bso#11690). + s3-parm: Clean up defaults when removing global parameters; (bso#11693). + Use M2Crypto.RC4.RC4 on platforms without Crypto.Cipher.ARC4; (bso#11699). + s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703). + ctdb: Remove error messages after kernel security update; CVE-2015-8543; (bso#11705). + loadparm: Fix memory leak issue; (bso#11708). + lib/tsocket: Work around sockets not supporting FIONREAD; (bso#11714). + ctdb-scripts: Drop use of "smbcontrol winbindd ip-dropped ..."; (bso#11719). + s3:smbd:open: Skip redundant call to file_set_dosmode when creating a new file; (bso#11727). + param: Fix str_list_v3 to accept ";" again; (bso#11732).- Shift samba-client sysconfig data into samba and samba-winbind; (bsc#947361).- Simplify shared library packaging; (bsc#966956).- Enable clustering (CTDB) support; (bsc#966271).- s3: smbd: Fix timestamp rounding inside SMB2 create; (bso#11703); (bsc#964023).- Add quotes around path of update-apparmor-samba-profile; (bnc#962177).- Remove autoconf build-time requirement.- Update to 4.3.4. + vfs_fruit: Enable POSIX directory rename semantics; (bso#11065). + Crash: Bad talloc magic value - access after free; (bso#11394). + Copying files with vfs_fruit fails when using vfs_streams_xattr without stream prefix and type suffix; (bso#11466). + samba-tool: Fix uncaught exception if no fSMORoleOwner attribute is given; (bso#11613). + Fix a typo in the smb.conf manpage, explanation of idmap config; (bso#11619). + Correctly initialize the list head when keeping a list of primary followed by DFS connections; (bso#11624). + Reduce the memory footprint of empty string options; (bso#11625). + lib/async_req: Do not install async_connect_send_test; (bso#11639). + Fix typos in man vfs_gpfs; (bso#11641). + Make "hide dot files" option work with "store dos attributes = yes"; (bso#11645). + Fix a corner case of the symlink verification; (bso#11647); (bnc#960249). + Do not disable "store dos attributes" on-the-fly; (bso#11649). + Update lastLogon and lastLogonTimestamp; (bso#11659).- Prevent access denied if the share path is "/"; (bso#11647); (bnc#960249).- Update to 4.3.3. + Malicious request can cause Samba LDAP server to hang, spinning using CPU; CVE-2015-3223; (bso#11325); (bnc#958581). + Remote read memory exploit in LDB; CVE-2015-5330; (bso#11599); (bnc#958586). + Insufficient symlink verification (file access outside the share); CVE-2015-5252; (bso#11395); (bnc#958582). + No man in the middle protection when forcing smb encryption on the client side; CVE-2015-5296; (bso#11536); (bnc#958584). + Currently the snapshot browsing is not secure thru windows previous version (shadow_copy2); CVE-2015-5299; (bso#11529); (bnc#958583). + Fix Microsoft MS15-096 to prevent machine accounts from being changed into user accounts; CVE-2015-8467; (bso#11552); (bnc#958585).- Update to 4.3.2. + vfs_gpfs: Re-enable share modes; (bso#11243). + dcerpc.idl: Accept invalid dcerpc_bind_nak pdus; (bso#11327). + s3-smbd: Fix old DOS client doing wildcard delete - gives an attribute type of zero; (bso#11452). + Add libreplace dependency to texpect, fixes a linking error on Solaris; (bso#11511). + s4: Fix linking of 'smbtorture' on Solaris; (bso#11512). + s4:lib/messaging: Use correct path for names.tdb; (bso#11562). + Fix segfault of 'net ads (join|leave) -S INVALID' with nss_wins; (bso#11563). + async_req: Fix non-blocking connect(); (bso#11564). + auth: gensec: Fix a memory leak; (bso#11565). + lib: util: Make non-critical message a warning; (bso#11566). + Fix winbindd crashes with samlogon for trusted domain user; (bso#11569); (bnc#949022). + smbd: Send SMB2 oplock breaks unencrypted; (bso#11570). + ctdb: Open the RO tracking db with perms 0600 instead of 0000; (bso#11577). + s3:smb2_server: Make the logic of SMB2_CANCEL DLIST_REMOVE() clearer; (bso#11581). + s3-smbd: Fix use after issue in smbd_smb2_request_dispatch(); (bso#11581). + manpage: Correct small typo error; (bso#11584). + s3: smbd: If EAs are turned off on a share don't allow an SMB2 create containing them; (bso#11589). + Backport some valgrind fixes from upstream master; (bso#11597). + auth: Consistent handling of well-known alias as primary gid; (bso#11608). + winbind: Fix crash on invalid idmap configs; (bso#11612). + s3: smbd: have_file_open_below() fails to enumerate open files below an open directory handle; (bso#11615). + Changing log level of two entries to DBG_NOTICE; (bso#9912).- Ensure samlogon fallback requests are rerouted after kerberos failure; (bnc#953382); (bnc#953972).- Ensure to link with --as-needed flag by removing SUSE_ASNEEDED=0. - Always use the default optimization even on pre-9.2 systems.- Remove redundant configure options while adding with-relro.- Relocate the lockdir to the /var/lib/samba/lock directory.- Cleanup and enhance the pidl sub package.- Require renamed python-ldb-devel and python-talloc-devel at build-time. - Requires python-ldb and python-talloc from the python subpackage.- Update to 4.3.1. + s3: smbd: Fix our access-based enumeration on "hide unreadable" to match Windows; (bso#10252). + nss_winbind: Fix hang on Solaris on big groups; (bso#10365). + smbd: Fix file name buflen and padding in notify repsonse; (bso#10634). + kerberos: Make sure we only use prompter type when available; winbind: Fix 100% loop; (bso#11038). + source3/lib/msghdr.c: Fix compiling error on Solaris; (bso#11053). + s3:ctdbd_conn: make sure we destroy tevent_fd before closing the socket; (bso#11316). + s3: smbd: Fix mkdir race condition; (bso#11486). + pam_winbind: Fix a segfault if initialization fails; (bso#11502). + s3: dfs: Fix a crash when the dfs targets are disabled; (bso#11509). + s4:lib/messaging: Use 'msg.lock' and 'msg.sock' for messaging related subdirs; (bso#11515). + s3: smbd: Fix opening/creating :stream files on the root share directory; (bso#11522). + lib/param: Fix hiding of FLAG_SYNONYM values; (bso#11526). + net: Fix a crash with 'net ads keytab create'; (bso#11528). + s3: smbd: Fix a crash in unix_convert(); (bso#11535). + s3: smbd: Fix NULL pointer bug introduced by previous 'raw' stream fix (bso#11522); (bso#11535). + vfs_fruit: Return value of ad_pack in vfs_fruit.c; (bso#11543). + vfs_commit: set the fd on open before calling SMB_VFS_FSTAT; (bso#11547). + s3:locking: Initialize lease pointer in share_mode_traverse_fn(); (bso#11549). + s3:smbstatus: Add stream name to share_entry_forall(); (bso#11550). + s3:lib: Validate domain name in lookup_wellknown_name(); (bso#11555). + s3: lsa: lookup_name() logic for unqualified (no DOMAIN component) names is incorrect; (bso#11555).- Fix 100% CPU in winbindd when logging in with "user must change password on next logon"; (bso#11038).- Relocate the tmpfiles.d directory to the client package; (bnc#947552).- Do not provide libpdb0 from libsamba-passdb0 but add it to baselibs.conf instead; (bnc#942716).- Package /var/lib/samba/private/sock with 0700 permissions; (bnc#946051).- Package /var/lib/samba/msg with 0755 permissions; (bso#11515); (bnc#945502).- Require to install libfam0-gamin from samba-libs on post-12.1 and pre-13.15 systems; (bnc#945013).- Update to 4.3.0. + Samba "map to guest = Bad uid" doesn't work; (bso#9862). + revert LDAP extended rule 1.2.840.113556.1.4.1941 LDAP_MATCHING_RULE_IN_CHAIN changes; (bso#10493). + No objectClass found in replPropertyMetaData on ordinary objects (non-deleted); (bso#10973). + Stream names with colon don't work with fruit:encoding = native; (bso#11278). + NetApp joined to a Samba/ADDC cannot resolve SIDs; (bso#11291). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + "force group" with local group not working; (bso#11320). + strsep is not available on Solaris; (bso#11359). + smbtorture does not build when configured --with-system-mitkrb5; (bso#11411). + Build with GPFS support is broken; (bso#11421). + Build broken with --disable-python; (bso#11424). + net share allowedusers crashes; (bso#11426). + nmbd incorrectly matches netbios names as own name; (bso#11427). + Python bindings don't check integer types; (bso#11429). + Python bindings don't check array sizes; (bso#11430). + CTDB's eventscript error handling is broken; (bso#11431). + Fix crash in nested ctdb banning; (bso#11432). + Cannot build ctdbpmda; (bso#11434). + samba-tool uncaught exception error; (bso#11436). + Crash in notify_remove caused by change notify = no; (bso#11444). + Poor SMB3 encryption performance with AES-GCM; (bso#11451). + Poor SMB3 encryption performance with AES-GCM (part1); (bso#11451). + fix recursion problem in rep_strtoll in lib/replace/replace.c; (bso#11455). + --bundled-libraries=!ldb,!pyldb,!pyldb-util doesn't disable ldb build and install; (bso#11458). + xid2sid gives inconsistent results; (bso#11464). + ctdb: Fix the build on FreeBSD 10.1; (bso#11465). + Handling of 0 byte resource fork stream; (bso#11467). + AD samr GetGroupsForUser fails for users with "()" in their name; (bso#11488).- Configure with --bundled-libraries=NONE; (bso#11458).- Adapt net-kdc-lookup patch for post-3.3 Samba versions; (bnc#295284).- Remove libiniparser-devel build-time requirement.- Update to 4.2.3. + s4:lib/tls: Fix build with gnutls 3.4; (bso#8780). + s4.2/fsmo.py: Fixed fsmo transfer exception; (bso#10924). + winbindd: Sync secrets.ldb into secrets.tdb on startup; (bso#10991). + Logon via MS Remote Desktop hangs; (bso#11061). + s3: lib: util: Ensure we read a hex number as %x, not %u; (bso#11068). + tevent: Add a note to tevent_add_fd(); (bso#11141). + s3:param/loadparm: Fix 'testparm --show-all-parameters'; (bso#11170). + s3-unix_msg: Remove socket file after closing socket fd; (bso#11217). + smbd: Fix a use-after-free; (bso#11218); (bnc#919309). + s3-rpc_server: Fix rpc_create_tcpip_sockets() processing of interfaces; (bso#11245). + s3:smb2: Add padding to last command in compound requests; (bso#11277). + Add IPv6 support to ADS client side LDAP connects; (bso#11281). + Add IPv6 support for determining FQDN during ADS join; (bso#11282). + s3: IPv6 enabled DNS connections for ADS client; (bso#11283). + Fix invalid write in ctdb_lock_context_destructor; (bso#11293). + Excessive cli_resolve_path() usage can slow down transmission; (bso#11295). + vfs_fruit: Add option "veto_appledouble"; (bso#11305). + tstream: Make socketpair nonblocking; (bso#11312). + idmap_rfc2307: Fix wbinfo '--gid-to-sid' query; (bso#11313). + Group creation: Add msSFU30Name only when --nis-domain was given; (bso#11315). + tevent_fd needs to be destroyed before closing the fd; (bso#11316). + Build fails on Solaris 11 with "‘PTHREAD_MUTEX_ROBUST’ undeclared"; (bso#11319). + smbd/trans2: Add a useful diagnostic for files with bad encoding; (bso#11323). + Change sharesec output back to previous format; (bso#11324). + Robust mutex support broken in 1.3.5; (bso#11326). + Kerberos auth info3 should contain resource group ids available from pac_logon; winbindd: winbindd_raw_kerberos_login - ensure logon_info exists in PAC; (bso#11328); (bnc#912457). + s3:smb2_setinfo: Fix memory leak in the defer_rename case; (bso#11329). + tevent: Fix CID 1035381 Unchecked return value; (bso#11330). + tdb: Fix CID 1034842 and 1034841 Resource leaks; (bso#11331). + s3: smbd: Use separate flag to track become_root()/unbecome_root() state; (bso#11339). + s3: smbd: Codenomicon crash in do_smb_load_module(); (bso#11342). + pidl: Make the compilation of PIDL producing the same results if the content hasn't change; (bso#11356). + winbindd: Disconnect child process if request is cancelled at main process; (bso#11358). + vfs_fruit: Check offset and length for AFP_AfpInfo read requests; (bso#11363). + docs: Overhaul the description of "smb encrypt" to include SMB3 encryption; (bso#11366). + s3:auth_domain: Fix talloc problem in connect_to_domain_password_server(); (bso#11367). + ncacn_http: Fix GNUism; (bso#11371).- Disable rpath usage; (bnc#902421).- Make the winbind package depend on the matching libwbclient version and vice versa; (bnc#936909).- Backport changes to use resource group sids obtained from pac logon_info; (bso#11328); (bnc#912457).- Order winbind.service Before and Want nss-user-lookup target.- Remove fam-devel build-time dependency for post-6 RHEL systems.- Update to 4.2.2. + s3:smbXsrv: refactor duplicate code into smbXsrv_session_clear_and_logoff(); (bso#11182). + gencache: don't fail gencache_stabilize if there were records to delete; (bso#11260). + s3: libsmbclient: After getting attribute server, ensure main srv pointer is still valid; (bso#11186). + s4: rpc: Refactor dcesrv_alter() function into setup and send steps; (bso#11236). + s3: smbd: Incorrect file size returned in the response of "FILE_SUPERSEDE Create"; (bso#11240). + Mangled names do not work with acl_xattr; (bso#11249). + nmbd rewrites browse.dat when not required; (bso#11254). + vfs_fruit: add option "nfs_aces" that controls the NFS ACEs stuff; (bso#11213). + s3:smbd: Add missing tevent_req_nterror; (bso#11224). + vfs: kernel_flock and named streams; (bso#11243). + vfs_gpfs: Error code path doesn't call END_PROFILE; (bso#11244). + s4: libcli/finddcs_cldap: continue processing CLDAP until all addresses are used; (bso#11284). + ctdb: check for talloc_asprintf() failure; (bso#11201). + spoolss: purge the printer name cache on name change; (bso#11210); (bnc#901813). + CTDB statd-callout does not scale; (bso#11204). + vfs_fruit: also map characters below 0x20; (bso#11221). + ctdb: Coverity fix for CID 1291643; (bso#11201). + Multiplexed RPC connections are not handled by DCERPC server; (bso#11225). + Fix terminate connection behavior for asynchronous endpoint with PUSH notification flavors; (bso#11226). + ctdb-scripts: Fix bashism in ctdbd_wrapper script; (bso#11007). + ctdb: Fix CIDs 1125615, 1125634, 1125613, 1288201 and 1125553; (bso#11201). + SMB2 should cancel pending NOTIFY calls with DELETE_PENDING if the directory is deleted; (bso#11257). + s3:winbindd: make sure we remove pending io requests before closing client sockets; (bso#11141); (bnc#931854). + Fix panic triggered by smbd_smb2_request_notify_done() -> smbXsrv_session_find_channel() in smbd; (bso#11182). + 'sharesec' output no longer matches input format; (bso#11237). + waf: Fix systemd detection; (bso#11200). + CTDB: Fix portability issues; (bso#11202). + CTDB: Fix some IPv6-related issues; (bso#11203). + CTDB statd-callout does not scale; (bso#11204). + 'net ads dns gethostbyname' crashes with an error in TALLOC_FREE if you enter invalid values; (bso#11234). + libads: record service ticket endtime for sealed ldap connections; (bso#11267). + lib/util: Include DEBUG macro in internal header files before samba_util.h; (bso#11033).- Avoid a crash inside the tevent epoll backend; (bso#11141); (bnc#931854).- Remove the independently built libraries ldb, talloc, tdn, and tevent and the post-10.3 renamed libsmbclient from baselibs.conf.- Drop redundant doc attribute from man pages.- Update to 4.2.1. + s3:winbind:grent: Don't stop group enumeration when a group has no gid; (bso#8905). + Initialize dwFlags field of DNS_RPC_NODE structure; (bso#9791). + s3: lib: ntlmssp: If NTLMSSP_NEGOTIATE_TARGET_INFO isn't set, cope with servers that don't send the 2 unused fields; (bso#10016). + build:wafadmin: Fix use of spaces instead of tabs; (bso#10476). + waf: Fix the build on openbsd; (bso#10476). + s3: client: "client use spnego principal = yes" code checks wrong name; (bso#10888). + spoolss: Retrieve published printer GUID if not in registry; (bso#11018). + s3: lib: libsmbclient: If reusing a server struct, check every cli->timout miliseconds if it's still valid before use; (bso#11079). + vfs_fruit: Enhance handling of malformed AppleDouble files; (bso#11125). + backupkey: Explicitly link to gnutls and gcrypt; (bso#11135). + replace: Remove superfluous check for gcrypt header; (bso#11135). + Backport subunit changes; (bso#11137). + libcli/auth: Match Declaration of netlogon_creds_cli_context_tmp with implementation; (bso#11140). + s3-winbind: Fix cached user group lookup of trusted domains; (bso#11143). + talloc: Version 2.1.2; (bso#11144). + Update libwbclient version to 0.12; (bso#11149). + brlock: Use 0 instead of empty initializer list; (bso#11153). + s4:auth/gensec_gssapi: Let gensec_gssapi_update() return NT_STATUS_LOGON_FAILURE for unknown errors; (bso#11164). + docs/idmap_rid: Remove deprecated base_rid from example; (bso#11169); (bnc#913304). + s3: libcli: smb1: Ensure we correctly finish a tevent req if the writev fails in the SMB1 case; (bso#11173). + backupkey: Use ndr_pull_struct_blob_all(); (bso#11174). + Fix lots of winbindd zombie processes on Solaris platform; (bso#11175). + s3: libsmbclient: Add missing talloc stackframe; (bso#11177). + s4-process_model: Do not close random fds while forking; (bso#11180). + s3-passdb: Fix 'force user' with winbind default domain; (bso#11185).- Prevent samba package updates from disabling samba kerberos printing.- Add sparse file support for samba; (fate#318424).- Purge printer name cache on spoolss SetPrinter change; (bso#11210); (bnc#901813).- Correctly retain errno from Btrfs snapshot ioctls; (bnc#923374).- Simplify libxslt build requirement and README.SUSE install. - Remove no longer required cleanup steps while populating the build root.- Remove deprecated base_rid example from idmap_rid manpage; (bso#11169); (bnc#913304).- Update to 4.2.0. + smbd: Stop using vfs_Chdir after SMB_VFS_DISCONNECT; (bso#1115). + pam_winbind: fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Make 'profiles' work again; (bso#9629). + s3:smb2_server: protect against integer wrap with "smb2 max credits = 65535"; (bso#9702). + Make validate_ldb of String(Generalized-Time) accept millisecond format ".000Z"; (bso#9810). + Use -R linker flag on Solaris, not -rpath; (bso#10112). + vfs: Add glusterfs manpage; (bso#10240). + Make 'smbclient' use cached creds; (bso#10279). + pdb: Fix build issues with shared modules; (bso#10355). + s4-dns: Add support for BIND 9.10; (bso#10620). + idmap: Return the correct id type to *id_to_sid methods; (bso#10720). + printing/cups: Pack requested-attributes with IPP_TAG_KEYWORD; (bso#10808). + Don't build vfs_snapper on FreeBSD; (bso#10834). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3: smb2cli: query info return length check was reversed; (bso#10848). + s3: lib, s3: modules: Fix compilation on Solaris; (bso#10849). + lib: uid_wrapper: Fix setgroups and syscall detection on a system without native uid_wrapper library; (bso#10851). + winbind3: Fix pwent variable substitution; (bso#10852). + Improve samba-regedit; (bso#10859). + registry: Don't leave dangling transactions; (bso#10860). + Fix build of socket_wrapper on systems without SO_PROTOCOL; (bso#10861). + build: Do not install 'texpect' binary anymore; (bso#10862). + Fix testparm to show hidden share defaults; (bso#10864). + libcli/smb: Fix smb2cli_validate_negotiate_info with min=PROTOCOL_NT1 max=PROTOCOL_SMB2_02; (bso#10866). + Integrate CTDB into top-level Samba build; (bso#10892). + samba-tool group add: Add option '--nis-domain' and '--gid'; (bso#10895). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + Fix smbclient loops doing a directory listing against Mac OS X 10 server with a non-wildcard path; (bso#10904). + Fix print job enumeration; (bso#10905); (bnc#898031). + samba-tool: Create NIS enabled users and unixHomeDirectory attribute; (bso#10909). + Add support for SMB2 leases; (bso#10911). + btrfs: Don't leak opened directory handle; (bso#10918). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: fix keytab array NULL termination; (bso#10933). + s3:passdb: fix logic in pdb_set_pw_history(); (bso#10940). + Cleanup add_string_to_array and usage; (bso#10942). + dbwrap_ctdb: Pass on mutex flags to tdb_open; (bso#10942). + Fix RootDSE search with extended dn control; (bso#10949). + Fix 'samba-tool dns serverinfo ' for IPv6; (bso#10952). + libcli/smb: only force signing of smb2 session setups when binding a new session; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + socket_wrapper: Add missing prototype check for eventfd; (bso#10965). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + vfs_streams_xattr: Check stream type; (bso#10971). + s3: smbd: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + vfs_fruit: Add support for AAPL; (bso#10983). + Fix spoolss IDL response marshalling when returning error without clearing info; (bso#10984). + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279). + Fix IPv6 support in CTDB; (bso#10996). + ctdb-daemon: Use correct tdb flags when enabling robust mutex support; (bso#11000). + vfs_streams_xattr: Add missing call to SMB_VFS_NEXT_CONNECT; (bso#11005). + s3-util: Fix authentication with long hostnames; (bso#11008). + ctdb-build: Fix build without xsltproc; (bso#11014). + packaging: Include CTDB man pages in the tarball; (bso#11014). + pdb_get_trusteddom_pw() fails with non valid UTF16 random passwords; (bso#11016). + Make Sharepoint search show user documents; (bso#11022). + nss_wrapper: check for nss.h; (bso#11026). + Enable mutexes in gencache_notrans.tdb; (bso#11032). + tdb_wrap: Make mutexes easier to use; (bso#11032). + lib/util: Avoid collision which alread defined consumer DEBUG macro; (bso#11033). + winbind: Retry after SESSION_EXPIRED error in ping-dc; (bso#11034). + s3-libads: Fix a possible segfault in kerberos_fetch_pac(); (bso#11037). + vfs_fruit: Fix base_fsp name conversion; (bso#11039). + vfs_fruit: mmap under FreeBSD needs PROT_READ; (bso#11040). + Fix authentication using Kerberos (not AD); (bso#11044). + net: Fix sam addgroupmem; (bso#11051). + vfs_snapper: Correctly handles multi-byte DBus strings; (bso#11055); (bnc#913238). + cli_connect_nb_send: Don't segfault on host == NULL; (bso#11058). + utils: Fix 'net time' segfault; (bso#11058). + libsmb: Provide authinfo domain for encrypted session referrals; (bso#11059). + s3-pam_smbpass: Fix memory leak in pam_sm_authenticate(); (bso#11066). + vfs_glusterfs: Add comments to the pipe(2) code; (bso#11069). + vfs/glusterfs: Change xattr key to match gluster key; (bso#11069). + vfs_glusterfs: Implement AIO support; (bso#11069). + s3-vfs: Fix developer build of vfs_ceph module; (bso#11070). + s3: netlogon: Ensure we don't call talloc_free on an uninitialized pointer; (bso#11077); CVE-2015-0240; (bnc#917376). + vfs: Add a brief vfs_ceph manpage; (bso#11088). + s3: smbclient: Allinfo leaves the file handle open; (bso#11094). + Fix Win8.1 Credentials Manager issue after KB2992611 on Samba domain; (bso#11097). + debug: Set close-on-exec for the main log file FD; (bso#11100). + s3: smbd: leases - losen paranoia check. Stat opens can grant leases; (bso#11102). + s3: smbd: SMB2 close. If a file has delete on close, store the return info before deleting; (bso#11104). + doc:man:vfs_glusterfs: improve the configuration section; (bso#11117). + snprintf: Try to support %j; (bso#11119). + ctdb-io: Do not use sys_write to write to client sockets; (bso#11124). + doc-xml: Add 'sharesec' reference to 'access based share enum'; (bso#11127).- Update to 4.2.0rc5. + Ensure we don't call talloc_free on an uninitialized pointer; CVE-2015-0240; (bso#11077); (bnc#917376).- Fix usage of freed memory on server exit; (bso#11218); (bnc#919309).- Fix tdb_store_flag_to_ntdb() gcc5 build failure.- Fix vfs_snapper DBus string handling; (bso#11055); (bnc#913238).- Update to 4.1.16. + dsdb-samldb: Check for extended access rights before we allow changes to userAccountControl; (bso#10993); CVE-2014-8143; (boo#914279).- Adjust baselibs.conf due to libpdb0 package rename to libsamba-passdb0.- Fix libsmbclient DFS referral handling. + Reuse connections derived from DFS referrals; (bso#10123); (fate#316512). + Set domain/workgroup based on authentication callback value; (bso#11059).- Update to 4.2.0rc4. - Add libsamba-debug, libsocket-blocking, libsamba-cluster-support, and libhttp to the libs package; (boo#913547). - Rename libpdb packages to libsamba-passdb. - Drop libsmbsharemodes packages.- Enable avahi support on post-12.2 systems.- Update to 4.1.15. + pam_winbind: Fix warn_pwd_expire implementation; (bso#9056). + nsswitch: Fix soname of linux nss_*.so.2 modules; (bso#9299). + Fix profiles tool; (bso#9629). + s3-lib: Do not require a password with --use-ccache; (bso#10279). + s4:dsdb/rootdse: Expand extended dn values with the AS_SYSTEM control; (bso#10949). + s4-rpc: dnsserver: Fix enumeration of IPv4 and IPv6 addresses; (bso#10952). + s3:smb2_server: Allow reauthentication without signing; (bso#10958). + s3-smbclient: Return success if we listed the shares; (bso#10960). + s3-smbstatus: Fix exit code of profile output; (bso#10961). + libcli: SMB2: Pure SMB2-only negprot fix to make us behave as a Windows client does; (bso#10966). + s3: smbd/modules: Fix *allocate* calls to follow POSIX error return convention; (bso#10982). + Fix 'domain join' by adding 'drsuapi.DsBindInfoFallBack' attribute 'supported_extensions'; (bso#11006). + idl:drsuapi: Manage all possible lengths of drsuapi_DsBindInfo; (bso#11006). + winbind: Retry LogonControl RPC in ping-dc after session expiration; (bso#11034).- yast2-samba-client should be able to specify osName and osVer on AD domain join; (bnc#873922).- Lookup FSRVP share snums at runtime rather than storing them persistently; (bnc#908627).- Specify soft dependency for network-online.target in Winbind systemd service file; (bnc#889175).- Fix spoolss error response marshalling; (bso#10984).- Update to 4.1.14. + pidl/wscript: Remove --with-perl-* options; revert buildtools/wafadmin/ Tools/perl.py back to upstream state; (bso#10472). + s4-dns: Add support for BIND 9.10; (bso#10620). + nmbd fails to accept "--piddir" option; (bso#10711). + nss_winbind: Add getgroupmembership for FreeBSD; (bso#10835). + S3: source3/smbd/process.c::srv_send_smb() returns true on the error path; (bso#10880). + vfs_glusterfs: Remove "integer fd" code and store the glfs pointers; (bso#10889). + s3-nmbd: Fix netbios name truncation; (bso#10896). + spoolss: Fix handling of bad EnumJobs levels; (bso#10898). + s3: libsmbclient-smb2. MacOSX 10 SMB2 server doesn't set STATUS_NO_MORE_FILES when handed a non-wildcard path; (bso#10904). + spoolss: Fix jobid in level 3 EnumJobs response; (bso#10905). + s3: nmbd: Ensure NetBIOS names are only 15 characters stored; (bso#10920). + s3:smbd: Fix file corruption using "write cache size != 0"; (bso#10921). + pdb_tdb: Fix a TALLOC/SAFE_FREE mixup; (bso#10932). + s3-keytab: Fix keytab array NULL termination; (bso#10933). + Cleanup add_string_to_array and usage; (bso#10942).- Remove and cleanup shares and registry state associated with externally deleted snaphots exposed as shadow copies; (bnc#876312).- Use the upstream tar ball, as signature verification is now able to handle compressed archives.- Fix leak when closing file descriptor returned from dirfd; (bso#10918).- Fix spoolss EnumJobs and GetJob responses; (bso#10905); (bnc#898031). + Fix handling of bad EnumJobs levels; (bso#10898).- Remove dependency on gpg-offline as signature checking is implemented in the source validator.- Update to 4.1.13. + s3-libnet: Add libnet_join_get_machine_spns(); (bso#9984). + s3-libnet: Make sure we do not overwrite precreated SPNs; (bso#9984). + s3-libads: Add all machine account principals to the keytab; (bso#9985). + s3: winbindd: Old NT Domain code sets struct winbind_domain->alt_name to be NULL. Ensure this is safe with modern AD-DCs; (bso#10717). + Fix unstrcpy; (bso#10735). + pthreadpool: Slightly serialize jobs; (bso#10779). + s3: smbd: streams - Ensure share mode validation ignores internal opens (op_mid == 0); (bso#10797). + s3: smbd:open_file: Open logic fix; Use a more natural check; (bso#10809). + vfs_media_harmony: Fix a crash bug; (bso#10813). + docs: Mention incompatibility between kernel oplocks and streams_xattr; (bso#10814). + nmbd: Send waiting status to systemd; (bso#10816). + libcli: Fix a segfault calling smbXcli_req_set_pending() on NULL; (bso#10817). + nsswitch: Skip groups we were not able to map; (bso#10824). + s3-winbindd: Use correct realm for trusted domains in idmap child; (bso#10826). + s3: nmbd: Ensure the main nmbd process doesn't create zombies; (bso#10830). + s3: lib: Signal handling - ensure smbrun and change password code save and restore existing SIGCHLD handlers; (bso#10831). + idmap_rfc2307: Fix a crash after connection problem to DC; (bso#10837). + s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call; (bso#10838). + s3: smb2cli: Query info return length check was reversed; (bso#10848). + registry: Don't leave dangling transactions; (bso#10860).- Update to 4.2.0rc2./sbin/ldconfig/sbin/ldconfigh03-ch2a 1760090087 4.19.8+git.435.78ced6cf30d-150600.3.21.14.19.8+git.435.78ced6cf30d-150600.3.21.1gentestlocktestmasktestmdsearchndrdumpsmbtorturegentest.1.gzlocktest.1.gzmasktest.1.gzmdsearch.1.gzndrdump.1.gzsmbtorture.1.gztraffic_learner.7.gztraffic_replay.7.gz/usr/bin//usr/share/man/man1//usr/share/man/man7/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:41070/SUSE_SLE-15-SP6_Update/5add5f7dce01a5b57b4b9abf50b932e5-samba.SUSE_SLE-15-SP6_Updatedrpmxz5x86_64-suse-linuxELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=5e53c6ea6d061bd8b410761e5938061ae5856a16, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=e1757d3baa0909b4180d8783d1f7fac77eb9eba3, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=0da2637aa067c967dacbd48522d607985c68ce3d, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=a96f01e01700a576c4cee28ac9daed09dc7817e3, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=d383296cd0ce3c0f4d1a26a1a6bf6d437dd5e6a7, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 4.3.0, BuildID[sha1]=092caa9ab93a45c79539dc418d8953e697d5f84f, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)6i634.R RCRRR(RIRtRR$RRlR0RRR*RGRRRRRRRRRRRRRRRsRBR)RkRRRR/RRR'RRRHRRRRRFR#RRRRR RCRRR(RIRRtRR$RRlR0RR*RRRRRRRRRRRRRRsRBR)RkRRRR/RRR'RRRHRRRRR#RRRRR RCRRR(RIRRtRR$RRlR0RRR*RRRRRRRRRRRRRRsRBR)RkRRRR/RRR'RRRHRRRRR#RRRRRhRyRtRRnRR.RRRR7RRRR0RfRRRRRRRRRRR-RgRR6ReRR/RmRRsRRRRRRRRRRRRRRRRpRtR0RRRRRRRRRRRsR/RoRRRRRRRRRRRRRRSRRAR,R R3RRERRRRRRRRCR"RRR5RRRbRR0RRGRIR|RQRRR?RRR`R RR&RR RRR=R~RdRWR RRRjRRRRRRRnRRlR*RRR^R]R\R[RYRZRUR(RRhRRRRRRRRRRRRRRRRRRRRRORfRLRMRKRRrRzRxRwRuRyRvRtRRRpR9RRR7R;R$RRRRRRRRRRRRRRRsRR@RR4RRR/R:RRRRRR_R RRRRR#R}R RRgR{RRHRRRR6RRRmRVRRRRRRiR)RRBRRkRRRPRRoR8RRRR!ReRaRFR2RRRDRRRNRqRcRRRR+RRXRRTRRR1RRRRJRR=tՄZ3@Butf-884b84415e1e344d23a6fe3cac2f7877e782a1266c84a1b100618266c84388518?7zXZ !t/m]"k%42_fR6mH> nBh]3JiBO!i4=ru!53_NJjYG$2lc qW>5bY $ȹ:xOJX%dJn/VXu[{[qQ[!8+gY,6g׶[1Ԩ0WSst2Fg, ɛ^<#ôeYہVάm2YI!0 '%EUf6b8R9꒍[~*:gR"r-ƭy #}8A@L:d0&=Gú~Alr!o*.6"4iyNB#VpIj Wi*_pd'=nT=RV!ӡjPfQSU0esX=KvjHwרfA<Vf nb_e92.#"-B]o,ܥ4ECH&kU8 vfb7:{ c,z95 H+V0මAQ/Y~GSk:u-CJ?Ityl uarC:~b%FPg^uC?_\K!3?-5 +]u .Vzn/I+10~ɦ}YFFKyovy=a&U ԂU4C\L=GFò'cR ⍅`_{uN'H^>QE1d$b(7^??N瘁$ai>M#b'mHX9'Z_SoXyJs>N^T٬yg/lAc[3}RwKe* f]q[U Q zjE8tO* r½?N: iO)pƻ*lL f^wBN0jrw([8)rݣ0bQJ3'h`6t^ˀްKMфڙq; hsNS=8vʎ}֩4լߎnSod ;F'f਼ZB. YIIl_MD{$ 6Eh*DK +} sp_ՙ2n(8 3#?O p[l +$T+h7 &|ӑ\,hx} vg{ST dY:0A F<5 о̑HlCSL 2s)DD*:Wz5R3zj 68p<娀 bQ Q5@OI" aʹP0|3iB vK.:uG۩_W]fOԯdnݖ,#ypΎbJ62,=˻(8r* GS:0=΁LO lxsu…}`z|_ф׳,vڂo"Hsdҿ.I?٥jDܐ g ĩ0YAvֆ!GT!Hǭ9'UܡAo~4$\\˚, Д&ٿ#ɛ'qgŢ<.i=5r* K!p٥z˕цJhƗi^^k]4Og6瞵]`4NNNt6l?=9zIцCw%*礡v LO3'f4_4"ׇJK!=*+U?Ǻ4t.G2\/D$C/$HBts2 `˰2S(gu;l5vlCZפ$f}'W/[TeR6<8Q4ax\mz_htr}Nٟ_bgK2݉dv"0 > [nh N$;1mxejdD״qrVB{33G\iFA)ݘ!(7S% nW?WPχNz3QJ6v]ny_GMEYu@9g0GiݢO;Dy[+%X. ae>>$JT&ϯb>} 68U^WI'xk`Z"Ն6w3jح[6oXMNt$okשkjmD96/`oT6FuƏaD`t3I7t=T\yTW)!\H.Ye C7b`/+b[lmd1]< P߿x\׿zjCӎ6yj0x[=?dbwޔq&14hNv9i ʑGyƘRn['|)L8ƚ y^0/r34 L봫>I?ՙ[9QuRy|CB*K? {SK"$' OELs"C"gqa:WL#*{,<ik5@= JSg=5]gTX=U9[uS6 @^ieYV:+us][v ntl!<+$ (dIy4ZA=}n.O`T>Oa!&Ε-AmSuȩyN*N5`W~?1>Ky%2ٓfUS3<#;}ru~[5rn4id='S_}ZV@U1E*h$޸$Ar.pt%#=6 (wvZyU躭EbM%bė6nx9C=uq5u=27ȗ"qr8G I,dgeSOk|P)##)'sیD^]ІxfLqLAZ BG2TL; 2T8!mjoO/r$i-&ĉ]sjshd|=I>N(:3ed76b}oI-ԴiPV)!ZQ{ZD9uQ-r\rWp0+KHfi$|T0D9٢w 1~ZR/bqNL'>PLzCUZ)?||8"/Vj4K~`YeΫb CyafW $)¥^ḱqBYHŊtgȞxtB {©Ѻy[hiB+u<OyJ p5ELy_TN45- -*Y0K|;OKg""ϑ ;3o6~Ε3:,'a$=Fc`V3UT"zw&UrLUQ鼉qqƢ[bTpILvrk6x ж? #9'r-1kIф?倿3Kz*ަ҅RBAT\( S%mbV9 B 0v.̌"ZlZX5}WQSn?Xxm>Ey#rjpx-6;h,TqVl"<,Ӹ"=سa˫F$=z0m¹{/O ޷$}%+8&sv <!o'ۤTqRU wUڕ[}B>-[ɓA#*6bJx-| =IW2ww+2mw1.R'Ótm} `.h(TH\ _L[^zjC*XPpu)&ňzhJђ9ү ۂ|mxDyHr>2~ԈjLqwk-L-HYx"^Z77b¦΀Fd׌1kSWWHGwDFr+ʴw59{F="wnेVB`.E|3WD䯘V0S} 4(MÂ1Ҏ?PU| D) 8vPay@+:d:2q>1ZHU9nՀ1zLDI SJ9yjt\b}?S-Hz^pt~u;Y2LfyC/c! ocElO[R 譹!($G$dw= '\Q/׬?/sj_^a븞{V+:Ir1Eq# ˍ tZIh%]%,YĀyު׺9 iE@~y3k 83fݠx3w;T޷*\%W0{;)&x:}qK9VGgcO]LaT^!JU5zh~SPPܶ B 3K(SaB]I)O~-[rm蓶t\oR|nf$%w8D/f/<hۤ@߀o5NrJ4 nfL-X4lpǛ?Δ{ Y'$D#UU!jh&,a\ag~J 2ks[dJ{K&C@j<;E:1Q[peE<2!)98A~FH^m[MvCyW(ZvYD[/z?w9iw3!GZ(2+E«uWR;H!Zw 9/`;ss5D:k8Ǭd[7 ]yɃ6G|VDa~1EPW&dx5U?UvB 'Lݔ#yKwE!N&~q ֱ?eT91{z 3#&pʧaDzklvHH5ŵ[S߾}7At12uFQLu&d%j?zUJ-?=%I M:5ՄTȲ)?H,˟-lb< 8KLa^a^*M aAuxQeg4cig#Y˃^-:nu*e=D~цp2eɜ`Hf)??bXo uЁKdPiBUxAh`ӹ+) Q+ n<;Sz롗k%愖2:)3V`c)|S<_QciumiTuG!`N*tveNa_8YNWb}L \ NY_unEݏ73i†Sep?=ktuƄA#ijS o7l| 9IƑ$}vx((^IQQ`\mרAU'dŲ[_ԗkUvYZFFLH(h"&/`OcuC dvmVO| di-CGw\`0j~]}$zE2`շ8M f'Rw/!0+{߬lERHMxkus+DR ІxT]ЗɤjT\R^| Q#N]{UqEi^Vo\NQVp;pn ?$ }E|OS̾AK-/Y8O9MS|׵R 8kAma4Y  .?$ A\me82ƌGT L/>1V67Š;ÌW[C5?pEQ0nI+:Dy/k(4if0ndtDM{0ϫHK< {Xŭ m0o3?DX ^pcQ0 SHC8"34O Rn@@ KjPI3pcQ?&dU>]/KFG3$b{iI`R3p I%)u +牲ycpr4D F䴊&!ڝ'@mr-;xI<=Ym`h!BjUH +K:3ձy@J"EH!Vt첑w_?ȤԖ)yjY4jWǍ֊^O N,(#ϵJ 1A,|V`FFb`\~Sw1ovGg#\8^fgdQŗ@TUD"5;sj`̣ Gv++'e,FRvCB)G7Bvsk,/mw1-:g2x@[2[^b ~T3@dUru6&Xg#4-M:~(מzی< L92oPt&Dn m#[/󙇜"bMf42+gc4jJ;ҮƟS*fho_ r1VϢwDEBZc]8-Λwe+1mˡ#:@ M=ܰ$oRs{A-f=t`4!rLMKM,Et[8P!k]Pr2As?$YW(~]ލ\T6* Gk h.h/m.Y|8Gubʯ9EcG%7qrG}~P@_QF@\6tAE2^7ˇ@aq#o3Oh5 ,{toR0XDzU:2 U2+ͣ@YÇG2zRʘ c97:pR-pɠ,2^$.0!$<˃%Ӳ 9eO" O$A888A &f 4ю 8QJ*a1C!?ږf`'(vvʻz%Uyfق7Vr6YUwy_?b.$;0.BH_pY~0 э0Rqϥ>vc$) 2G' @t8cmQRF} <:}{2)ꇻ?>LC@8H"p9e0S<6 v?2DRݙ+[EIS,9V}B1uN ueVXls[&߿ЭFXhS#Eh\ïSu':#e-*UxB]`%zU)2f* j)=]ya<ޱe12tL<^Ny+cW^vֹ4[eg`|Bge՟q}byU3k% \,?P<`vk~Gf<BK2>Vi"S4]u퀘A-U3'&ᢜ{&'&U˼B]6)BhSF-!d3'QʿOiNSS+dمqد@ o]efS8utm}W{/r~^V߹~":돯nwYVIV ŢEϫslAD)He$\AAOY<{yKD@Lw`CKZꃯ $ p9ОanI:eG}V>ǤS6v|waM?|oW- ܢq VSa1kn鐌ʞ ( :-D'v{AFSP|bm[' JWF<\|),$\QށPN<߼)11^ډUWZ]˖_:da0j'嶎bC#O*?42P{(Bbx] 4^o awzo:yFbM1qj햺`Yr"x[Ld4YX(-f*{QZFEj;0V'r:̹LtO&Y'q6rW㎑j2D&`4m*-0rT,UK;7G'L"e߇zLZƶR|RGW2_`||lBfh~lytKmͶdܬmq?DP8lr)جzi4+'ssׁ2jkxd_i;۴DC 6Cz5 aQqdTid>%dGbUgQv0NɎHXwG8JhL 8K"7F] 52.p|#OZ2ejH0u٭Y  (p{Uwf~,aИג左"Sb(kC#93}<εP6.@'d8O ""twYv1帐 ?u-ާ p킽xN$( 3n VEđ?R;9 #OeX6Y,&>6GTz : cĊ buyKSw1ts ˯yueGѬ0.]v4+R#e1E+mvmj7 K\_|4]|'MC*O-ʞWs`1+ gU Aq1dFl.<"Yr'v}A*~KdEk M&s$a`q@@ZF{qDdtMn7H%z.9-EipҔZCtϽ'_*ԏ!fK^VO." /j\#Ӿs1ӍC Tha=4CSNJoN1рK2i]vB\ } 07E{+j~ CڽU S2 {ZdE ]lϤu>؊\znPkx_5up3Ye/+Y2(Gݥ67Ϯu70څ]?8Ȍ ukhIq@Gmwh^mv$~'nn=@X@ܯR3cz|i)S%^6'$5M,5: T2^\oFyvXջ14CDƗ'dp}+=R&vb]C½ZStn79 O)%=3SP>J=?{qCUղ,¡9Tpg_\gfFZ~_L fo,|8+ F`޹T]F7rTtl?KHSǝ;ȌP%LcvJEDžl}ؼL_o.,{|ֆP)~<YWXM3п7oe}&pv ^%|.? d?tn,d>rW<)lb]t g:rN7|CO5;6᠏o5To>oM@Z{.Pli7tezn?v *;Ù69V[z~^2GGڡfP#d_q+*S!%" 魓S '8/S."3wR,À@s1.ò~jD,3cO4mZG+VXI*"VImL á2)Ul9[NwJ$z/ vk7I=}.m N6iԋ@]!Tlۇ l| 3\ۡ7ZP1VR6{J^咛?9h ZSHاGf2Y.Bx0!A&lýIoXb]-k/6E*$+F`Z4Kv )`1'd鸈C4Qfی r$O<vs=Q6Y沋T4ωR,?8`$x鶧(XH='I8p5}.Q+Ӻ5tx9$z,Bj>Ҋ9Sƥ|Fcڣ€-{Ȳ j0-zs`O c1b@j'Kȉ:~s()$~WYc$;nA2xEgh̎[~ 1M\ZU:QzP٘[έAv8DrGNTuMDZ x68T~n-6Rț~$͕Q`KG8x;M[$D4KKs-Lc<)s3 "0Rd'RVLH-9B;+V奱@X Z8B[BQ_iBQ#e0xA='5mp:uһW^Gm嶛b-n)-y҃t=){#'؏N? .F!jbɐ!e6q #uΫw63X'hIf׀0ЈfѢ9 YN"ٯ~1ocJGm =J}*NF9#BP$Dt@[L1(.Ky00@3!sJ\-?;w3Eqc iķ1bVR"o \RsJ+1 z@sJ,i„@c%/>!J[NOl\hT0Դ\ 7P#P&~\SbZMl=h !6}ȚH) LsNWtn nK|iͩ} pTgq~90lap狕PMD8Pn9:gtp ~Ni>U.dbR`QM@zfRΆmZ0)ڳ cftqB1'!VU-`#2޶ D7,i?5;f+m'ކ#YT?jӊZH5]++`T!Aڊ8scBSoٲ_kg77U;ؓIZ)aj!Q9qpWzyMZmlh7<&=LË_y26(j5=4($N6q/{h&> frBª(MD͎I Mj$Z"%o;}8#iG#NmV2 %#qwݦiVȔ%@X|KǍq(1>Nxև?)Q FD헑2}XKvŸcU<ɄsM,fۡ\B'eW'eK(o.)3f)/QS wtI7~YzEL\{pH9-X2>rmA0;h:ttunx+( 8mw%Oy FX݅ά;#JШLou _<[[V+5.t>dz8Z/ z4Nͤj#ȇ#)]]ızټ&WeMhGK:[NNɖJ* 2YsoO F͠K[:"--lY`~<9t WkӁn2 lrێrpq>[Éӭ҇s؀uɝF8FZeJZ0n KSV8uڮEK!\M~\^o"xZ@Prky(j1}`%/zKl7u7:@AB dE~u--eͣ[V>>$G0RX!Sұ[~ |`GzpͰ?Hz0y`pRr%n}|a3r{z?jJVi2c]رم+ߧ=ю̡:= э5y2Խ%~A >})ݕ;Ko&Ufaaw0U0t$3u4+@k-A { N)C\3,N) )p#cSd2yo{a"D:#Fzjw7 i(YE>Q*'ny.Dt'zdUʀgXvN]3Zxl}3a7L*U -[#/U2=!ngGFNUhK3׬ PGV6$M̼VLc_t&rZ"sr=.ZtZ/RP2piKlȄRF0QYxAً*sI1+olA~;I)I¯VΕs[/'Px6-K/a(K[;ŗ\Z~2Fç :+qt*02ctCv־ ߃`LjR\^܍QAl?KT$.t)#C/^'o= MW6\}vf=bU/VNyZ?GPe^cp0+`F}iS){glp-g\b):!OǑ[{X>*PԆrI!]g֒&K>rOE LuxJ2VzۍْnY)$ F'L\\")lN* ,#g^ 1ڥOq.&͸< ^7i1CA$OjtI?XIjPִ?哙|?M-%𻛅hɦT;\8@TmuR~H~f[ȱ0 7,:J]D'žТkU+f hYiL?u`TƜx0=޷w~ۈX. UkԻS͹I,APEn+snؖPuOk)b_y?IV2hzZ0/Y>zGJpZp@˻:LtZ~GZyAoŸ,}M",:"/炇ȋ $1D N 0sPc=C5֕s D-q8LE985e 3Y\˛crWj܏W0_Go*et2DXB^LA2QJPTGKta * vM W60ۢ~t؛*Sn5 טBgx(e jqz @;^ E?a5 P, Jܱk{Ra.L(`RK2Oa4pi',b$MgEKIhr !%]>><9aONzxK*ܕ*2]*S#%# hB[95b]7+:uTx g.y4\nqC(F[) %xn'okо@Aq gJ/T\sn t>j a 3𳴛Bܱ VڏD`nG$yx*@a$az5,%JEP.*.rİG6^ga!+ikܚVh-LGj3J'\L2E$,W&Fer;w|_ġѿ[7\|FzG {9M-whƬG<k5(N/ZMׄ}7EOB3Vc ju0S_MW~}ZAap `]C'Cc7STqO!sʠ_ }>Ӝl9/#p2zR9 &\ 5zYrb`ftE֕C˹N q%7{K ,}Gɻ?Q&_wNSLȺK1J8y}׮$\Jm('@ЅA\>|Y *IZ%Z$谋+XGս`!ˆ}yYG``z&<Ѿ=@0fIw6C5AXLg}kdS.]">my!^,L<~z*ʧ@/ɒqm+kֿX+Hj+׀c{5d,وu:>s@A[$Nz$j/ N0p溚/v]lvÿ^MH'k.kZ%N*lrb GYi~#f1Q0ຍ,\߹o3y* l9۩2$.ҝٸxznYR >Zdx$i)6~ ~M1Taos"Uq1U]R\T@(Qe"Q*u=2KTCxz e- Ε럨-i^ǂÊ6p:w=%Ndl54A{oejNC$GK焴V9^yGw?r"\^0@#%MүpȞړ;Iu[ / NU_GQTO'l`hXmlxjI }-Bμ/TzlR$`CҮhE7z;:-=AOZ;^"wtFRGBi-_VaL_J`.ob*1k I37=~>ASrKzs$c )6.3S#)eCԵ\P=ms|asEuԴn89$Xe7: 3Õk3ͭE輧42Q"jT'~L qttV|q 71@ ^ 6f@2\0rLBK)nNEِSomlG(_ ȅA KdOhy} ~T d^в@يw[}화Nϲ'5VnWܶfk3yn޻3E`t=*(_c2SV!ձ_=|߼;־ڎ HⳒ]Żj)H:sjt*?q\0HV[gY]8 &h9r>x0HP&&6 7SRvY lM7gϾpZ_s_@;8i;v_4&-sL%P5vm;~9m`eF]ɣ[b*&geR^nHĭhW=}e\)qϽ0jpؓG}_LNZfRv,֗vÐIlF7M?fc+GPq0Ik X\f)l ^UQH˥\`omyIAh3`y ƢYW\`oVn1^\Q_y.V6]BնO$B'i>A 3 R 'eL"{'y6 **/iRҦ~feRm!Ŏ_*NJ9)2Og@p>SR:ߓPﶮW3)j>*Źk};㰷F@kEu~iKw5T|^'؍4MU%F!T @&78͚>aՅ'(U8sxNcf7g$Zۑ>"Lד4fG/Dג̗߽9n߼~w[2pClO7Pkx ^^"҃R2)ZO_M`GC8|:{|E} ,"~,~vXErDzR?R+~<.i,h~W[{.{VN¶T 1gcmƺ–ҴJ>P,N*Ƴ_\0ӱ.>4f$ g;.#ngp'C7Ɍ$X ʑQ\6덫 ^#Gl dvc O% H./ok-{zo_y9<%!Uz[JG~ڵsȂ*|E'݌ލ }{G츏v>"9WcEw.Nc<x3rL_ kl2ͭLnc׺v55;hiUmE"] ~f{XhIIoU[tAU=Ik@r/,fa̷ީ`mJg>wƜp&iWʕ)E$bRSq7Sz9_n;#K g,IB hnBF!‚;#|YP`"Ee.iBfAQI-1q vj1!a-NK, 7 ?^X]Р`woyKpK5ԳbHFBL梠9FkV`~“^m+e('<}I]5[8OZOAdYB4%檳D㺛1B2ԧ k-OqPa@PJb ?3OZA "Rr";5IGBPk] G>Bj@$q{AU(},a\LJAA2| w N =N%wL8;$;*xw?/Gnbp^jB/9ih]Y`[ö!1[)x86 ӋYu6lɠw٥!yxgKCbRS+t0 2l-R|mZ9 ƿبd->gmdHχO$8yRgt@X$*ҋ0,Q*ş? ~a/D]j%o =)$>)j.%f}pp=b s"`%,XmC، U664rb?Lqdcm@ǚ;؂B".)!NM1QM WxttU/_8d$% .*`҇K/(\)zBb9}H@^둩 Xg JJv@&Tg4b:jxh*٬JGvi]N)6U7c*)`1j2, (ѕ+ksJՔٸk?? cOC^9 E\|+aĠ#ͦjF ryZ&WE4 7[vG"V'8}0N_뜝Ou$Ø>!{9IӮA&j&a-wSex}5g}*)LTqۋg6DW'e@ctTA御Ɔ6Kb?'Rto:B8jH! 8kMC\/[l.,ebNÈnAwezMb\}u9|[4#(V 4uv05bZQ*)C>sضf hXtC+{-IykkI)O߽ ×H$9!r}sNZ2--1sHQ&bm̡2 I B,WhiOSVL#osNю7f*Yc8T ~)ɞ6U2\|)Ӷ WeI|pNTeEdof%,H&vNZϰQ,z`qlU()fdORMLyNVHzaH½:ԓǡx0Wead;0jw_MJہu[59,}3Qx+K)VRR`ln2J!(/*"'_\2RȒ.>tDpS٪gۢzzkWGH[{ A Ŕ$ve l%6W˸<'z {ө"dzlبy@#4>8(JAkJ.B9Ӈ~)߸ $Nw_!xQI}t: Y sfP2C. %au}=2ykKɠ _vލZfLkPv131&Y#)vw6)#0̩ PΛץrVEUŪD&@' V`3HS(Y@NϽLf s#%Q0D-7N16eCv~К+O t^p*P2gN"ILFj(Ht\$Px,ΚiЯ?Ua2Z~'sf1"y),Ks`Ff06bVo*gL<>:t=gW+ͅ$ȣ9wBt"8ľ .9o-sÚFk6*.#)v7jC)߂UӰzN4xS0ϢC3Ⱥ+hee`s7kRqrv҅kX}TPZ4 hzKhUD<:2xb/TS(.MjEEKFa9XL'&${G;=Hn+Rk7P b Pb`.)DE\vL,5P,'G?} Зf.{pw"Ŕ-fy2|ŢEP@mB*9g5.7zYs/^nkk- v`O-ӡܷAde= 6v;X%$@vó4n5c ^T`8S>Ū!䪺tN/F)A$蹸"zQIFֲ0IzMɅ2 k.:ۚ\{KK'"!鱶~tȍ\g=;,\q(ռE h˭"Y㬫t[T)JqԳ`@X;Ox~OEm/""r^Ǎ,AH(Kxkw~@hDiw_DÍٜ]HL#IV\.l% r4Xq> \ NB{-~Pf܇t>볩I)-"CNNPa\SfϬE<P}=(_KNAX'|QIphxnN75bd~}y0M8\@Rx[Rtͼ X'*2*I$3+CۂSx`/|$NtQYl84M/-HXr;6zvaX^$x/>_AVLvU8b+yD"P&90X!pU`W3SwxrIt-FU ;m꧱@ x*T&0Ы /X S/ JHV@J`T D?TjHMj8!ۏh9ț^_lzJu܎cid#a2oǭx-wb/jޗĘ=Ea O:}W8+#q!Jv^4i}֖Z=mґJ@tq/ȼ`Pp<\{p_hI%Po1u0[WčQSJ|r;tVl&LW0c5QAߜ]hU{QTJ='o F`'KֿÃCqn3<1 EѯtQF ~׀ȝ%5kl)ro:;(J uE|i%S%α9dY'#f| i =>e#V{^f\i`%.$Xl4UlG@@>:/ Sk;O @1MMqAhdp͎$ϒ2GxlHOb _dD6ۊfנ|m({.BO"T^|U@*J.4WnW.DS@R'v3wҧڄT~&R=}5-FLX{}!7S ?Vn4"CTA9=Y|E0 ^PL/af<1Cf$7Jwaܬ0d+3糞X8GIl:BT*A%>ijxZJm O5_Ӭ-ŕjfrٜrfq=qh[2xx߰W/o>RH+g Qesz{MJW.K)fІ0ڡ.^V{vu@w;jl᣷ɃjhĄH5-~vg&tp=wv}*2݈X"j-޶^'d Jtш|\LT,=lp|-y0?9uh0勱{0gf Ce';uF43 G_箢H'>ӵu#<27MNL^ .ab6Wk4ױ_ Z5 OObS_8C~fEFl PB6z̕3+">L7AsG^OT7X)jri\=U֥.>8&a³C5hC,7'1(6t$^}VBzmDlZnGED 1 F nGP[tZ)+ 2+jՉ~,W05_H#|b<&W" ]|a?v(w#M~#Z:>dV{ k*?\A֤ Ib5tUR@K:Ι$utNժ&65;83ȾuF{{ʈ@mivrJ*=Jw9jz GX\3a4AH>tvKߙɱѥ3Nݐ[UyL^\FLV,q@g zOjE\4$ ;$AyLdVUsoM =K}/JQ?kūݻEM*C (kSNcN#׋JA+fJ]\xdb=3&SDo*d~2ʤP ;+ߥRUu-~&ȉK䎶 hbC~K$`Y|p'0n-nĀcX j_>`5RC:f5]`W@wp1nNy.[$hFe^'" ?۱_hvb !}ϼatQ3b î{8V) ݐ uwU1x/^ ظ՘)\A6$3X.ژbHQq>:'Gk/d p#d;;D FhbH(Ǟ'.M! jq ulddMTPXߘj^*s}B[ҋ+ۚ"gh2m;월co<GW5w;"yc2GŎJ]O,1qɨ EWdKޱ3(L8eP;6"JNT\z9n#.2OyAy4bq.hѹr;N+-IWtv6ox1vؖOVhmQfl7F!0 }-%)꣗?UzO{ 7`.RAO ,#Q>u~ [K /Ҁ!'u(X%IC䏕(a)9p]nɸJRL 60!-4JxI r;8@ܕi~lŲ~]/7v!:a?ب]JU|I'udxY튚SL8s5͙F-zXNLɐ5kSl~9²+(+n'oJTA"X%C .c'5C{}@ io%$G2%%sC씁-@F7Pl1!s>e$Ε+07Q{o"y30KMJRߋDIƣp *#C@j$}LZm㟳kwkF"Tƶ%S_4E!@WxȠ~\ʁ7').K[= ;:d j570aD1H `ABGx<;vv1䥒dn".ej6]BY y|HSS) 3$CtQ~M/ڛ%\ r8ے OˊqQ;Ʉb'Eo#Em_mUA {$:P@4!z|~Oqߨ+@i7EV\&]$e1&<9b`pwW? I6/c,QEe /[kD‡Bر(jFvڑ- Ի]\iUE{iYwغz`9G%J/F;5N|OT9o|6"2DޣchC@k5jHõ1*g Ym,04e"Lu9LbbWy&DskB }=gtgx.^j@ ܰ=hlY~lSr|H  O~BuG0eQzd\G8y 4T7Ef;9MND-r PVpECmP0;Rk53 K4zI:5IpKBT$IE0888t8ewD[yX-GNq-pY mљ[E4{ہeMp:>0V{j… -0zs$tJsހEz\ $sxK35RS5+,W<mDjNLBuݤOKwk]pkfμq'/B9u~+%Tys]Qdt%[xˡWLrWk-o'PIa@HX%fEz/ vWuCqU%=3I tL.'=4B@~Ii@5+hm4ep,3eRcf3{gʇK3P_d)QG V7ω xn^uej-oT k 0@8wBiv|5?Akމ\θ n>(j08H^ #v"vGZg5K6ʖzL:eZLo~_}c_۸ RoϮAi4!qbFXd܈7R7Pv@l ixy_R:^j & ])ȢܳН{`-vQL$UN8X )txcR9>g9Cbw1 fR.g[NOIlz|.alR߸Vm;,xN2_r[̿R[AE*ÉJg3qvp+9+ed`Dsq ~)1q I T:m>9s0i-7ٽB crxYTm~K{̺)5Ȯݴ:n!6ol{+r$l\' uS^ͷu^DVF kc<[3T$ D NqPgOqR<&v0pga$NHDb"P۞EYkEdGDhxzm39=XcxsGDj>/c@8{AF 6l9L ;^n 賅qMM>[ötED=Ȅ6Y~s4%u&f^<̙l.z>4yLX-% 3qQ:J륐oN:g ڃ ƶe;Uss?dpKse3? Ek.LA>)*\wKFlgXZ4~-U=U⦪#<ӃQBqE]͐GuƔ-y c|7TQ =j@ $]['jBhmT߰1uQ F~ q% QtMg,j&ՁhcXʫ7)V&\ ñ+q5lgi}] )n[wO"Y{xz|͚Ϟ`P*DGK5^1f ;w1߷2G2i1SN T߶Zʛ'ReծT% 0GBO]p P/a141XP?(xȔk(MbudؤJ<'<w$NB,w䐚策S,)X1OL<X{R"u@/Q .!:sr[Pc#u84x?$$*2n {HZ7 y|#K(tX!I'mWT *d#_E! }_ۇHvs9(dAJ}*D5܁AN['cFerdvf^C={ 9ޙiu)|}!ThA?k?P0HHi"٣ M#0 )"9`H>bGXB8^,@M0&>2iospԃ0]a~ΦFs&k!6f.6bfo i+&XiwK(zLbw| )L?@ǣf߾;+ D0r\]O9t)O dm)rAb21ȭɯ^SzDR6B>gǤϓ|uK(_qNYjj.@ljȾUcL s4u*\x*/1w9-|pqg+ jskp,Oion Oi8K{[c4hwȹ=휁ZG.$$պ&-Q^ũy D&5ajm6̜9^GT~|bEٴ; 1ޣ8S#. 5(#EA ^1ʌDx/< ɟ-]mu,Ov GHMyW yF֊~G| 1)øt?yN#Az!cR)5l? M:/!\VhƳn˄rsiX(}@guڻzCPxd.y>9<'`uSQaB2lL+``Bp?wLXYĮ$(! + n)=ϒ"FgH:Қ$|eθ1vR7t `sF0bύh?Z[Rb(-H@6ʕ36b&?XOᾷv>[/̐0"_<|4C_񡎂L>CƮ1I% jG`7Ӱ:75k` (rɏe޻qQnwQ4ZugG>W${Igo>NS]WP=#da;@ؒf:ѳح<[Xk\%lpٓKYd#/ W G^IHvzvz԰ٓ3ӀW=PQ ƥ{A'3XL}}&go(*8=ȃ|}2C2F#d/hZNIhۿ#6qU{3p1N2-5nW V2w([|6p@en%uՄ6-2!wn-c٦D /fc9=fwg䱽ǻfyP OSmĞYJ" 1ڲx5 {UQ42 1o\>uN)_+7\FD ) ه f/(qOKM)DMn}BccȢfAHTF>+Fl_ea0p-jx 1}+(^}} ~>^dOR7#3o"PT7Gy"dC1qnu߬ǶNÞ v8~#on;#bXC:5Rv'oIpaP?G~n?''[,pt SU48z7ZX> $z]0;pw!0>ĪplU \QH{)u7Mt_Eb wO?pa;ڭ`1Fg,ui.t)8 t_k"e3':+wEI$:J|_Htz$A|< <ɀf|2z$C_ m,%%/D.:? M+EqP5)7dԗ䊳6VQZɛ}m* xRGbW$0؄^RuRU3|G6W% NJP65_?м6E*w<3RSCM2WH*H:Ng^a`4buܑ^ ~z&I*|ZO*H7 Ʊn~s;ɐNn\sKU ]->]"h2/AVc@cKMZ+^7ow8 .: ՇL/9w@dz_U񌝒~ T0pub]v##h.Ww̉5~H vS EP>r?Ƿ.dH+XǰR^Y&k!FeV.{̧y- (&@$ CMJ\*[d,9fWvں#\d y1,ELE}Ўl9ΰ)̛q-chl˚"tS?f'ޘԥ.T\FAOK,K!bKtbW$t0D"LhVLӐ *pNN.R"y!R[2,"5QG O&z,i=B8fu ͙_y7ʦTԯ'mf%_z Lk MP{bRp]RQda 8NEBC 7K_q ߙgfmYAڙDϲ.oU {RjM;0,nI_-6Wb] 8`!w/_w{>fN08G?vlQ/1*D:.8n?6mzz{}DC2'9TA$qUUԾQ ǥJUtʪ=@82 0ϭuXQz+Ug> [D e [|l{xiرPl:)ef1cvKQsP8mWd D?ClZ8%!TF"~TVpUV5$$ &=Aflkmɺ \e`+6|,9_-x׋6qwN"m(g1CS.czߎ/3Bc&oIɝD`#_ Ryoރ5Jx蛕% a }=>4NG!{44W13,Q|46! $MG +lMdwTT703TI$w%]>n8:h%~rQ ̟\rmhMJCfՓQ-`48$꫏Jzȇ'dKir6l{cgs|v[<5`HNŇ> GD\奸X46j*P0T?lMlX8g͖_zΆ@;V '\#{0cBVA=i cjZjJFUn'+ިʕ϶jχ>'tޮ].pK>gMfrS% bmkJvoa:)m]zrE+>EocӨgj8B+uk_ [Zj J&,&79U0t 9iD팼9sCJ pģ4 (@ᯧ>gO(c ̅ģS6^|ۀ2n>,ZR/JI>nۥPzsT:u\ 0l.rI) dTlu7e|\E~< Y67@箅%G% .AGx0]@) ,U\fzOPe0؍RV 8 ѤwgW+n=T5RK7hۊmWuk Mg T0za $wɦ#kwb40WܧjXӧ>]'X)r(ȯ \ҕ, Sq򧷛 Fh)-W^2Ł]&xfֶ!S߷BG|N@! ;׍Ou[b í1lO}[ E"]-zPc9-zv-Z{#oC**+jTug~3A`fIw @Cm<'( 3uf&:{%VO20s?hxʔEel;&% #řMlZ `̰AL1M [7淇,M:/oP=ѣPwxt 3)*t .:YGNHѶ[["K,@"uhH)N F7a?^%:Je͛x.g>?S̀T(?]L೾mx |:*W_QM6EBĩ.Hm#ήL@_JK]?:ϕPǣ!zΟ}΃@aQN@@tqERtdj'!- #EnÍFrHvd;m2^i")<\,4ٝ%:F򰜲;Ժ+Cm +h=wg׎RIn 2"Kpd}mBƮ;9xH@Fł4JyVk`6+eCc!\>}~"u3/9+)8+W9v bG5amGIn-'gCvD%Dh-.X=af#w#ukEP1?5 )tI&زP;z%dGӖY!à|kU+Nd Vk^I($'fYN  ҂ե{Y:_F+0I nѿ C ]l~#q$3yϹL$5: Zϱ[wTaD|* 5 S!<0k)O 7iĪ#/\{3ffwٙQ()H'eLE1{X~8w+9Ju.\oUR9Y@qBa<|@h9G Djwnzn5?= gy޽o;I ;iJ_vvv@+6ץF3TqRǿR^ߨf0AEŜɠuTut;C4R/u,5&J79QYxރ?jױyױ:kB=}w =.MF|f`8bqpP0َ4߻l BG"om#KXA6< û lӝk"IOgҋ,'我n.[srrLh|fPl#s@˳0M-l24[`dFwPt]yMР"F3FF9@,.i[)pj Z7x2e&gۍT=J,+lQ{NњJ:~HL{МM\ͣ mzBK`#,M{C:Sҍ?[r8ة.#jTlyMmeBj\TH>kkzDRtµåsQ*T[HK^p>ZW^[SD{3q YA ~cHYFIH?~3M^pO|q7#Y8 ^[XgPE.7*OIHv˓!dE!fHLxҸc%CSp)^{9E:x>{r[<3;Ұo(lK` $UBI+XohsH !*ql⤥E5\ֵ|PHg[a-^ IKq%/leO<5#Hثɱ&/" йwwOԪҿI$S31A@,-@eѺ*eo`_bH¼tGRsvK$n6´wPx@o3Y͟xX@m[v#go_O=4(t 'GUUFP׼ $2dWr+GX=\bV\^kaS0zgs-OOg$%b_ Nu;9;oCu4FM|z9)FO,s'T&Nt}TdKWl'NbtxIa9;tyAlD`Y/}i$:|j<&W] Zz_fr_ Ϊ vaLd2B,O~06T#d4'aGWG> >c9Y r$Qa2LzКퟵ>a5_yl<.BKɑ})ǎgA b.{;@on"&ઌۤ"N'UKpY[1uDs5S*%76=.ԇULӮJjvY:бy S O<#ShTw̫t*Er Ix٩{ \sB'+]1;+ 0gFqR Qߥr-FIG\1sکe9~yY㫥P'> ԒʾtꅷzpWcLl0j&vyedNS#JK"Ou>u qTTA 0BD#1 PE~M {M=^3ӽ)@@4>Kh?'L˳hme=VEv|i} jR*mX?=xl}&>]5<5 FtK9_/14^Y||O"BA؎5T)"_D"<atŽwoFM{ ¸v|98kHbR4WDG<khv &JKVܣcI e2N0pְk|"|="#[X09hhGAfEP;'%.u!pjMhK\QT:G `jmnxDI 55>_+LEI<Qj\vK^&*F$~ fFwRNK;U`15o"fz(cn )҄]z4rS tUX L/˸,l|B;n&3wUSp(6A- FW,}n#|n몶 k(6 $!ܱB$S ε$T j̰p8²GAbLc&5z=]dHu Uf]6UMWlg}{.Wֳ7pp`s? Q:@^0V(v /aZ{*4Nklzg$n5LCD)@ u} &KřG [SQsFOKQJ,ԖAje&?7mL\l?*~U1={d1|<=i4Ԧ^q~B)ӥ' V@ 7.MSRωk dQYiqqBoGV8{AWIZa:}śC\S(DY{ , Ji(E':w($K,9 AZ:+*aS*-fonN"hf}}vו5Hؑd$$V_[Wɗs_oޗv4T67(akCV2!o2>;p0*vXZgEqxwjZps?BW1Qa'qЭ:a~=ogtQ jwa@qЮGcg9 Z\^̦N Ly}m8;REg;Mvgq' W g8KbQk\CRQ4t|.\R89&b,ߋbu<-ZۮyXzoM\`"̽T7-(3ߚ׮9ulgI-%%pF,e,Qa٣}V&Dp$  ^ٿe(mfxu܁5;oc(۽)gLYk iܟU/|ipK.%mx%8ͬ v_e* ;Xʤ\SሮIOO^='7ǎs-s>OT_hqy. Eh" Vd]y|fo][+QIf8!a{@zweN8ل ap;$X/U{%_tȻ fl/y |XznM-{* 'tߪאs%NmsMso'M#/ *)s"4#fQ*W΋x#x -/߫!Ef j*-w F1?e@c bk)D'~~~W8="~Su9;:pX/pQ-x%T'b? uDþ.E7'˭#{JwVSX+C]p`>USstcÁM&d:R@R??bpݐJ#x fq\Wi_'_ErWȶ~*AEg4Z>#17 BeM'4p{-3&S/2}cJ*~!47" N=VKk#Epzpt[N/<Ro{e4x2mG}籅 iWtS&~Dcw;+B֠~I,/~p^RxP%z@P>B*0eFp95^r0#=kbz(9ν3M&-@gޠ~f΍ x̧]tIZLzȡe?#.Ǒ- c@rDZp;RR4\D2Q@ɷEJ$ħ.1׈4 DOw(nY+` +h@s1AP$4c/ LO:xuNQ=[umMKwEJEҀ:ۦ0icDP^ RHw{8}^0a'lOɔwzZl5Z^J΢wy_TfHC *jlL8.cFbO.cj#T:8`)AֽĪMWĒηx =n3ܜ?f2fS])rBiV=B7yːVVU<n'tAs_lfo_VG+IЛ3y7s;@9/wMՠ sr+?oy"'S>RVYxt͜Y;Ooo8hHBCX#^[Z,^>4ur?|-bG 6]_>%٘8T?NґM˚!>fL~YiPb~3ZmW%aڗƘrFwJC(]V,Oo$Ob!KEn +A7^Cp 9=s9(~tϪgpxʔqL aFp<bQ$qYnv0pemaVY8ѨtY(k}-e,x? t׍q?fxȎHʹQi'6m/tx~[_ƣ5Iy(֍lНY!f"tDt:`'h&QԣS~޻RGyx(do?i~68*1\ܶTh5ڷAfoI]d X>ۼ9}1'zvjBLqbP/uQ9Vva?_ޕ|+4O)UvN8ω&T!ʱIcα%c-iEr,ܜN "'deEt7{٪Lo?jެZT󜄍yk5+e3#۳4hh =v&U;EZOUD_S3"1x GY>ҏ qlP[mVsKt`k2Ji0HYxڻTO.cw%g0֍Tl>ZIZ{, aܙLGS}@4"$HɉփAB;v1b8,:['qپܝE=b+"tlsX.f .mAWSVpt͗ǐxVс5oUIyGjnm,xi x*@ =n~El*7#uƸdXwBw^t0<H4x=yIGS< Q#Þr8|6S0U넶RDh5D49E+Es#h_kH0iSx("97Be8@bdQD"O!ɣo vbѲMh= ^$2jeVE9vyx_MN oTBuCI1f);(֔ j |E:N)@ T+=/y\^u&Xz hbfU#xR_JH6'fJL)|Zi;&̂~ j#VqƔؤ9jA6;dʪ[=\ l{ (7mgsB`#zjXHLCpkzo"Jүu:MmfbeBQwS7LX$buOOXYi"bΪkmɢӴm9̭[9d\:LC$TKWXnp"*ތ8o6 dbꮁ%*UykA V'Qe0j7$wQGGYװXLxo gFv^ft@`1v*{Ϡ%=D _Wf%F1A.bS%77G*"Ec Ϝ^/J1;J}XdaW2v8{K.H+"үYrHT h X6v6kh4#Dm[S37?OHÛ>|YxА$ΪJA;ϱZ](-39:g K6j*T"!}ZyB' t5&].f !G/PT'?H-aj)J&mR`pۑ}WK:V: ak1s[E=~s$ ʇq>C1\jb&7i69:6 |ЃK6h1J e H ߆o LzH\X;qZ SE30Zxp9V{[ρ#ӊƸ*:CCHބǏp*)!Vb8w;4^#Ѷ~J)/8Ԯ=GA<3M8hx_MU2IFm(3,-][yHxJn̍YLկ*ݓ!zevYv˔ػ:M懹uy@Mmoi!1F6IIUz97`"Q?aS$wzR b-gL'FT]}%ڼSSH4LFڋ8[5I5 fTd8SD!ܻ5{$|:UnE~@8rL{vϳ |.M{.+o[>(4aI/+~8E|D}*L?D\>0UhK={)2'İ H^w& 2OBȬkw:c@ jꌈ*5,#$Ȫ4܁ "2)\TX圷Cڜ ~5s[3{o>Aط!gwEt d nn&<d/fZ_([p ,KQ@ޗ7$xv~:xC>QKxbA(`~P֍$2# hQv?Bp(xzA"O7ȞtQ#ߥql5 Fkz%W]~_n&d0Vϻu*r,:ۇ¸[[#ZV]QsɴI-m5[&kdFUD^Gkvs38zA+mȋ*%Hw-w"Ai:s::q7Ex{t;>}5YMy # G$H6ރYL#ǷەZ}cۻ4ipPb pi@b]GFs4~i#oK%_/I\b@o6#le}yrvzrɟs-r tkKGouD`@99IK #Lç*Sʃ>Z>7loz]Nk=""bI Pf0%%fT#CPIZ6 ER<%#-Z'p6- t|RMRqXT&b- \8[FiпE34w?dܳa*C'~Ãvu\lY?t_xXEY7SlX֬ *ɚf"d L_zTiUf˭q^a%KWh$p8:7xS4`ƋRSNa zMة?[<කwX`5M)*&vIE" gaߘu~L>}64^L iJ￰wd\kO5AO. {-$pJ%vJ|C _m+T‡G#;6U17GMsg%IqĤG(ޑ)/+x$.FnjCo[@x ulS:v } JSՑO_-GmDtbwl("z G6<>)WsdnpL~=cGd>jpA'cuY֑+8(?ZVkhG1}yLcJ"sK!bk0&U rO sj3V@2QZ;Ʋ~Ey ozNe77Z]Xp pv fiw;l*+AdC*;@/_WsM[K qbVR҃R4{l"ǻ[%|KW|etZġ~uQtl:K0"g6$oӜ5h![Ut<:lI\h,Q}۝5kcΈ/y[rwH rhuҀoհAqI9XI72?5̕MV|7#Xݣ\/68bIH[SN9am0ɗ0{^њF7ڗjmvgGxnHhĎ4s#BS-1&ǚe^Lh=}rE,8m~xB*z@YԼu%M:kj6S65=skAɻ9U F9AMHpS+$,FYvu4ytC܎8ê=fChFxB`w L!ǐ")/~˩5u/x| f #uOɦ[?mdCF)*'DJ)f -WMN v#52$`>aTv/@9$nIhByLr^29{աYIqY.8RcMD`? Q4AMFH|U?$>,Zoq#|tge4 תpiQL@ 4V'dK@aDhc6: cd3iZϋTJI\l {U .|m͆ݙ&nY)0z.>hM2E*> sP]+ H MfuɆFr֠-hŀ=+_  gpf_?Ϩ t(S$¬x9)9d6A8kpvTfqJji8+ۊfM ` %.~Feο5Ǟ^]f>42hq&)Ƙ8SwJGAI΄}~C 9^cKrdA* c;8jxE>< ϕQ沐Zt7 \|y\OC]fqyh20}7u6㐚2JAtWuX⾠* 40F#0]S۴f6f[PKh*g"# d}$!MtSp]qZhڱs,z^//רm,wqp\}a;pjZgĴS <[BGɗ w4sjԶ"@#.l촢I2 K &-]2$HtDEy-Չo5p]"0(NpM\k>4G;FQRC71^T \CDa[zb1h.miT "e|*x1Bj 9_*rA2hNx=_li3)״EJ}ݕk*]AS&e pfdUMبVBi@L^UPH\xkI5?$Aq/GӇS*RՓ~c&Xq7MrdYcFE[g7@.)B-r@`i܉rJ?S% ^R=j'Nerx.q;8BU8A(b'$MPg6ilZڣV๨9f #v]mf VnB{]~A4LBۛgh_f9qRݧ=в ZQ2̳\͊^ce|rw㦉w%h-f3v$,Nh)ptu_%ΜcFba nE?K0c=;1YUD N؅ sL823τ 7/n|oFq>9T9 {dY V}U@)5ڕjz5},Rݖ_ ҟd+E}db]t.@=*X\9 O'Br6^MRYi ź@ږOnu [>=8|g&h(͡>v}xd"]ѤUTVv|d꾗ܭ" H8κ LQEg~[ l v~FkStA.§+9ŔuP.k1zT1} ]ϯ3XTy`m(vEN?[iq<8˻+EJ[\yy,xπ/#O2DLۚ;'_fs JSS0l-c_ݬ#m:DUGF# jgpC653Xiy:òQcJP;1NȄ?mx=~Q,A@y^0 $X̑+ eRpB SRJ?H&tq\(n$Q]O]:"'# ڀcNv00| 'Ye/'-뢦l䱛e =*6q귀Yf")XlY/$[w'LE3#q u] ydǐ4\hM5~\8}̏Pw`k<9 $ɥMetײ!ɛR|)xr1 y w3+vzYsJ; F9(cbmՒ˔w@Ӛ?*f^.kd*n{PU7<=ҀZ8eKkS-f@JgɊCHuAWn/桏\yCɽC)H wժ?2:4;Mę|j %HjF r:/F7( 0a-Y:& =)o87ɅRa'1*B&Fݣ:)A3P\^2ű=@j븬5UKtV~;@D)C-!@&mT(pG/.cn..uXbYyBUޘYغiN՞LRQքrn1Ǣ(DR>Q%嬽qD:Wz7/(LTU^t]?ar&56w*h ;Ix]}b`&AVx68:k[o(ȼwOt]l$h|> SevB mu׍nRm<5-!B6%l NEdh~-lB׍,'Nr tHT̈p)K0:QJU^HsL^m*q)qte &>R1Ծv_l (Ós/b B:u%tQ_}5]% <&`bgAru4PE~""`+t -1;m>bW]deT;;*(.K`_Q Uo1odJp&m:}S"ɯFXTd( 1Sa-L,ց_2=cش_Xٸe5chN>F-Mur1Yspk6f|b3=Zm&RN6>jc*b)\994v]q.uCtֿ0EWzyS9*=ji'ZuU(yUGѽ֎ګ LݨAzncdĕm܁ڨZ+Z\MXCs٣{k[zEEU7űsd?WW"N%:4"ee n0/2=Qܬ_!B[oM̂꿗JGAӇAA[~=G{t_vLR Uaӗض3jJ.ȆzCkGc47(ץhic-^ s3RuvÁnx^[pŋ#-@DL?}|`9H`oB\&k6|' *҆W3eN}xA +jkMwo1Lqۗ b#(3\ă%1%=6 ~I7Dh;rcWF/;Pȁy\.%띅HرdR )O?:(OJh y'N xS;aܤѓO@F@ ¢lki)Ez@ENTUxj7aD-mL]*/A-"6!҈# hS)މxR恹!8R^RJ D#om@&$aE &n()d,QA`HEdfuՓtSLα<$-gZ(=(l7`.oނf+ֈuES <: +@(qސ yN\T4e]qdxTtdvHyXBCȊ,DܤCLͱBm@Q6 GOt+)!n&Z}ms֐wĚܧT5{0סՅ7F%M;U@Yvmø@0^;p mǞZF  ȝ( N;Q:pwLcHpz[E7c#Mxm=Izj-WȕP - ؁2HJg:jA # qsiq7~)_7Ωl8P"DpPpѷ TׂJ Ej gkwd ) ~ٷWق@ajQNht *9Gو*Q)H3( PJw߀Q7"B!ɭ-m(M(׀v**]x;pGbۜ3<₁Q ("@׉5VRG&Z:]~)6ykAQPծ=Lcz lxA؆knCU2;6xVTg==&:8~mOQ@Tٓ ۜPuLb2󟧣L`9q۝^*"g:TpnRiڎwnCs,h7e3brgB)އSo 'VfŎx$s߯nTtP^(<]jRBv4tn X{KE:D/;6zѭFutO@N^9bH*z@1$88❻-+`C^va˽[PM8tX| abVq&;+*+㭭8aQ rac,FpK^Yٻ:1"w\־Idr^49f=8gX DĎd= ի"5 2@DeI؇bg"kNI݆nj/8_؈O=tetNxuy&q޾[{:@=Mkva91En{g[%m܈o@u0h()܂&46)3EQ;Vf)ݏwL ǂP"sXC(68ڇW^ 訧wEq@ ɵ V=iр=.9*b41jiVdDhF0 JJ5OU{UӉ7iܝ<]( 8Ay s/88 "޲gN_JB"',Sf=ϚVs@G?Sn/RAl3wC~ԀDsKN/ZM@ o`&%7 )Qç۳1Ev[{}{߷ h=D;~XVGk!@vut5BxAhpUkuOgggdlKkb+l{00utQUDQbdy{{{\4v;[?=kA@9ࣧmQK )̀H!ffAzU:/"(q̢gg|Ȁc" rIV{.ʼSowNOM&رhnhnݝ]:TNRr (5cwjWwT̈oPk26!pƢ"PŃ%C} +ܺ)8w86.C!*v9:srp#MLDq ۑ8 e7su3X01<։FĔ EuO$EB{JDQ`F2$$Sh@mªںMS B  ve~D #ԛ9QpY@@Zqj+r_;@Z(SƋ sQt뽒W>"K+2=BeZX::bړ4څJ'j\ְ SJ']Q`ȀDe0-xNil \6`rVcYdF/\r;\ḗ̈1fXLm4@e93KraY7x63! 1cz bźT9 Nm)"d%INc05SBqv d;D%G49 YdD޿Ԡ3ڜҁ,Ӽkˏ"E +NNePR#8nԫ.]n3~mU/ǯ.VhNuTX: ibh@R|JV1e5v*Hx~l! Hnn㭵rÍ”# Э-45$MkrfVc٩0VNmYcMCB&*Wr)7 Z+5Q(5@)Yۭ"aӢ(\7΢_T 'Q~- N粶UvTlBNc][HW.4a85IӇn}{h)P$ ާ4X" M+`@@‘;(;]5 m8[gB!{Z 4;`3.Oؙm|,mBkaFet9Z|71XVQ_5 'w,ͨΖ<^xIoct "w_Rv $*D]G@_SnDdZgЎOw<ĐE y&+a!=g{ q|$XUUEB k{kC>F(N3QCn(AiNM`2LƔa\0;>0,Qr@3i46BCxSbɁzTDҋAVuD@kn xh}ĩS,+^䁃*WD_.jͱ9UEE?ߊpe0 ZS$ ;j]{j=ǂ8xPZ}&ϛ5qBqr}m#jʟ+Ze}/*7I$ $O=E-|[,UG:+V@ lM[sE~?|_҅ S٫&jjO9u4迿I…ա[4 ݤ(mqlūc!ɤ:DC;BgUd9]tMbb>2"fUjJ58D=y^ =n9!g1""%D̞WBΎ45DΜ'Oo|85#4DӬ*M&׽5P-$AC*׊=ȉϧd";S;*l*Q}3Io|]1.*UFRX"(ҎQw`׻m⪲K[#gEd*=k `!DBt-`riB`t3rʳx/*W֭*Sy[:T*6)Wpt7sn{팡=4N[[ џۊ"o |(@C/;'LW8QAMbXOXz{.u Q||Ct{,_) D9" DAz202 jl,|B,Rٰ~/ps[qǼc9cQ (Ex芅4xo+}zN']!࣯r1KۮcCx%UT? (De7^Zr/!ߺZ4յ|jMtU??/7cA8"`E' ActzzXk*ug5eR;c,&268; &@XL`'2'unoԓ[vzC?= S!*fU,' @z݌iC= +4?/jwCzY0x& $*ߦnie|֑Gt5@d ӂ>*Ɋ!M~K;?iv9Z)YU LQLQAM>?)2&s 4eH2 TJ *Q C(}oo\u]P᧝=qrַ8?fhfV|M c0d@ `[~O|}mkͫv,Ȁ+۴3ZMd.3Y2/7'ަ::/{gѴ_QIy9J*D0CMgմO2SX7}[crT:PH6th勵%, Cd@ ]U[E.ZSI*XxGk/ yTs-S÷WP?*f~;j0VDQf@ .y;Om{[ηk*0Q%p-k726n 1SҜ\ : ʊD !hUnq\]N MQ+rsabhDDDA ~võ|tp"7l=0Ί(ڋiȢ^u rUwV"p0-QȀaϕ;9T";x|T`v[E{ʽg5* /6+ BxƆYjlGn}T b(FƗy5pȠ'D=WݷW7j%PXŔ[:˳Mh pECEE>_v;߽}^]E}d":d[EA31K~UpN4ѱAq*o? *]i?v#_1,]88'.M.w9! Qx82 @GEk4;s7ڙCAcW]_G:Am=og0mgorն+D@Ӊy?icT]oCp4AseEC<@mOՅr7D1ʁ>XG?Rhh.tC/t]F]rZ*e }=q$6O%-< C}8{Tā`b'5+!>(ykؠ3eH]Q[ngka" L [`5ED DOPB`᐀2+.K/ؙopJg^O^r6GK;fm-yCK)yd0-}NҨ+ywba4OA% @Ϟp4 ʞ- 3A 4>6dWޣOZGb] dK9}qE[bފIqAs?[ #F'|5M2h"O ,&dDZdC/;Jb0DCbb~eϭGO'v݈^ V_Ɉ!$DȜ0ɸ:]\J޽q8L㛔`,1RY%N}Q;eV_^d=ܾops_RTA ?Γ8I҇iq~;r^'WwYs|źz^H2 )SiK[Sp  yARXKީ|41@Nd!O/>e;okt<|I̸THI LDgx_;.&˼%&zqyV/Xc3Ze`0EM%ؒ& {|Ox򆕝Qq"a&*W+&@=/_n*'Ar猲qܧ\>LmBTa"!A0eJ-'t6@/2"6֣^Hw7Cԯ\V-}_w7/t @ L̆cqm`?qά:mrⴈ7:XOi?{P  ̅|@bnWB5Qo/aݠ52#2d,}fBÕ]Ktڽ\Q62"U 妤U{㣒mXslp2XRyb[筯^qP e:8D-ܹvwAשja!A,Ɫ?9]V+,17x&ڔYfRjek1xx~שk_?gL'~efKOATZs%"+4݁%e{Mbl˸)}q|8mפ p ]66]n"=<} Lf|xUZx:8+.+|l3qb3 [MwON΢ċ^\X=f\n1dNFo5qB+_[ZnGId w>/fuutXe$2dS&NQC0=2J{vN@dUTR5?(ˁYj_+ٮ~@6:cWr{2,kW[f,XHPiȷ믥g$z<~_yaճP :|R|u5/`sN~w/nKL nTߑ3ܑqO< ]̠.{b a{8^íO~ajWg^T  _"Wd+HԃQ:|ӿ?Mt]QZNw@n𱖥e@ #H2! n9O_W4ouDtuFB-Y]2ڿL7e̞֣XI៧ && D@Ș;$S.Ѧ Q⛩x :M}ڣ3˃ɖT/]ի! ϓP+]U{T?pTڻd6^޳kCdAC0yR._]P\5T\Ժ; mdK<+F(:lK=+%yխD'٪"P̌WsW  '̜ lo?ok]ܑˤi԰#F)b6 *%Cq?nj9b&OWS~ۊ5s!ĀŬrO!,)+،,xt?{Z¥d_oĦ3Z!6_o?]w|N3KHMRj>3xx[Q ߟmȏUD<dq5ke@%87O;KVib:2qFe8L.a~ s @G@c$qw? L_]qاVC"9i<'?@0z2vٝ(2m֦Ɨ7y?Þ)֓yQ ,8(b y[6_ eѿa[ZBs;N?r[cvX0*Cu隸b"ADEٕҋy!W-*q,in\;ݘZbs1 JCbE^SfwERE,);sL0VM%EŨm&0b͍E)jϼʢbEPXE"(,67\, "*" E=/'_ dP2Zc Tna>iqCS zmM:.UTDb tm.ǂl>L\YTs}{{yݏrT`űH  ,+ 7St |{vt,x1M~3}pd7fp8*]8*maJE[oHu_k~7uﹿßOw$TE=M#9Z"Y}.+_O3T<Fı-:*u2EJ$4&dA+swq z+Ǫum Gbx]0`CE. v|{%>k%A wD'ۏg5^6M^m>ʎU}E Eы~t/m86d5(̹9jh`Q0dC(h1H!#\di&)sNB_~gu_~gwyݯՂz's#@W!UM Qwo ߱Bʱ-~g۸3_8m&+ρqY#8u#Icm=ORs&!R"CgyV݆ M*:,o KQ%5&q5B-YܕY;5z+"c|FM*g غwGHGƧxVމorgr﵋/{\mcݻhݏu]ˢ Փ}^MdB=xFE ", AB) * 9KvZ -ڛzשYoɹd>:3xeS+s>z77αu[O к26"'MSsi[>+3y id}pn&?5t;Ƹ3qGvN]KwէVTOUtu^*zwų~Eu+P8\,ro!;SW%R1?3l oN$H$ǟ'/xo lC'ss4VI-o" w!=F^3z/R0@uc8i h0?4WJe FQp dôP/NߞWA @ B]|dTM__<{o7Gq5Dzϛcp.cیqg>_;N,xs@@ZP"ՕQ %{Ѹd7?9 s>;S<[obiIy k+jeGm+^l;-6p xE 2)/rB:pyJ+ˮuYՖat>Qd7MٜS t:Oĥm-Wg|,B@x|k"wL?]kbv&+u⩛)wsw10gƸ4qS* E&,eǫݶ?~R7v%k6') tMɌv0Tb$]$Q$$11~(}|Q@{zwގo.~տ7')c NVIBz||Bv ;2vɺ|jV6_+q4wsVWYq Na1^OS הTE}ӵ={/Pţ{2\"Uے:7W]3igW [qj*},=Zjj?2 -:=vKY lVP*$X*,UUb#DbbX,#"Ȓ{+_Cyx߿~1{ohǓWٯi=W룱pVjawgRٕ^)kڟ:; ҡQ$%Zɒ$ulh#X_;(=_uŬQk\  U˖`*I$ǩ9; "Dw(KMؤ`c *23f /z`$3ZA> @BQS}p':Xy-U{r 'Mu6 r:l9?8;9% Rvr+a.gL?('5!7!,u Q<ZDoTv$ JASХ1Db$yX!*+#1HXW<9 5?6vU&>Ǐf޾qjUJv힧|?tv I ab6Fbp݃ _׽!|_#HX*H]Ӭj,%9_C}N{pahiIz5Am0N58!0gt0>a ?–L#*dw}kᆠF`QnK>^הz^&lBED@Rsy|$TEDJP{Ad۳{)/,b`cg S̭NT(lI c4"#2>>_{^X AdXH (d"dAHdPd0EH AVEaH $HHEHl"" , Hh,ZDI/Ԁ(aA 0 )1:J$N=?wQ"*E@EbH,, ,I9sAP/ 郈(Q^DjHAT=VJ 2d_l3 Ap\QsIBi d(L{հg}. |\3=y| * G|O.O&HdG^"HG?8oaq$$Tb"*ǟ9>zdg>f&6M;&d:{ÖHϑ:9sWؤQzOpG7}l 0`2,ǐV $FRqK_scՎry|{X`xSnjҊ|x,F`,Qax}π^,KSBfF`ǡv.;XH_[by hƠI!q*;.HF`LI }ݧ7|++hʽ~0Db c`FF#<$Jk61l_!I nޅJfdB!/EU Ĩ/ïDZc!"z>F嘙UdR@ـ—aD#+,_y^)P:|ټ~D12!x4K?\tEl/ד:_A;)jVVOr˕E (eV4+i!̿&e^?Ju!&jculyq `L?^ \D$a^hTޮ$sAC?wͲyRdHujD3-YR5 FARl" "/cZnEDp8v=iW恏4%?AQhY9o;-XpG$'&{T-0cRK{ae2p\y@ v s^ߛ(:Yk_Oox =/m'\@=iKH̀)kEJ$EHY.jj;y'[__9UNWsHnPQb*E"(*OS~i͖m:}.Wz9P`T!LEHM׫֜\3H E֪EV ي#QQ0* (U{Z@|Lc&zQXBP"|Gy1.vb ~vU;}w}qOCOO=U9o}7۬C,:gqd(+b2aOy='G6]י7ujO⹖1]wC?7K eDlc<2T` /Yfv_ Hh-$|ዻ=JB'֒D Z!(,  <9cXޅFfwIMrHHIWϧrebHff|jwg!wgd3B;$N-k t&tٔ o[umv HoOA$!nGk~Ɩn8E`x'^ _d@Cl2kLdnY^"(E=*H@)|>+F,ޏ.៓`f!)$w9rSbTfl d dǂG螪*(UQDTa4>4 D7Ss\OMuj{qBOMJK;֬i*˙@r~#',deG5:ZL WͬY(#=i7\;VAC nݬ'Yk <|iCDCA8f0=SD&3K*]+ԴӢ~1FIjS0f#ѱՇu<l`lxX/|\RҴH`Z$RHCl8.r {{Qh"0,O~ FA-v"nь#ǯN[ZyȋqjؾWR($R@$Wd pY߯]GC$!mqS鯲r+^v/^0֊uUxw\y,emZ''j}PƶmVa6blz^_ -/4sق|DIъpZ}W$ D~jMz2Jݲ yd)$Nw]Z-؃WF L 5y.zq;hj8f7 ǭxܦPSk=2v8_ |&{I2/p [eK;P!y *Պaܡ =7jm[{&^--3@VԩԮJܨiG$S]-Y۫45(rnv1P:sJTgBgB f3aD/&^'YY6Ǡ47,E OxN`ɠ~¤-.5DP:S~^`/߻O\_,@Yg 9Y\hz}^U~߫`t/fGS}tQ#233Ka{~Σ0&5Uy&{F3=YO_=]tLdAǚKmbfffCT]֖T64;#}d/jp)ω# g~HE)zR3ᴭ_64ߢ/T)!@ߍz;~ 2dB̸J ^6-׽&t@ ɰ8F?5B'k /IH`,z*!_a*W3}<i"kr#DZw~֟^_D0g^Sd6<w3IGA+ɐnE6C×fA~3?^UUhO(e;}WSPR6*N\W?){ "Ι[oR,}٥rp*Y>y+\T>E{?s( pͽ-0wZO Xo!]9Q(C $^w;Tl]{Ms z>zsp^Ԓ\Pb[wn>UFC sԊ:b\v\EC`~ ;V$kSUNuYMfgCtDݧd5 Q!pZ8yp6 ! 3+80JU4o ?&;>5z|S#S~Lc $i7̟Ϸ'ȴ7@PfFdf |ݘfnJ38HRYnbr,SUv;QI`gq/%c0ʁKMY#;ѣ6k^_M5@B N/-A*@Kω>v g,N-gm)̶tRtF xmNW [+J8NU~FHP_MV& Amo^Sg}[-GNh81RkF֩ݼ0V(QK>8c8"Nv:f^wXkrΨf cOJ1rp *QDE\<=o"}R!VXSC`X÷o0cL[k7rzP2ԶV-O~cősӜ{A*._I-5^Tۡ0?#0n`3h$*w> T %3Y)ׇ0f 30{a/f&l)E%(ש^8;> x-{œ/d;z{;,v]((#u'OPB͔]5 $ӶZۭ^ޭ>FMpɰ7CTX6>B~g*q}~YN!#dT"@p*j [O'/hΆCxޱvbi>G2#2D?tb~*yo\ *WL ~{Dj5W*Qg"k&3*3dO$^ MG ("2&RF2,ȩR ' zg0Y"j`2ٹh*rvZfwvGÊ"#D"Ȩe *#@ѐn"1\q|h BFD@M҃x%EUZH # +l(^/E@Tn *_D3}H!dDN.ѹGDf&]LHԠ 06ݬe+_7hl'u_Fa6aO L06Z& ;Eg>=Oo{FUٱe?=8kf帀o8`z"x%؆qۣEUv@@3&AYtgS1&KI+b!N&ض.7zg]M42c}Y8ǒsW gx7Z rN綒_;*?~;?]i.S|<\riM20fftd&킧NN=#g~kbPZ.SyUҳ5xYǙ5kXt<6r'^F^xW rc;;-s^I $fF` $fHA/|f7Jj+.6z[Ng@YWj]; og)%{0n&|oؕexy$_$-B?}?N|ȣZ/ -CqPbcЃ/nm5k't& إժz'SXk ;t@"QZ˿p QZ=1&~jKp%7k"7 ā * r'QemjbNr ,Ѫ9 uĹw ֮pcW~VdxF {~O azغ-|uL"f'X0:ƨ*b:odg?ν^cݑSׯc̊INVT>{abr!AUB;劸 N8ok ~趤&4H1u)M,?mnn.ʱFNT_ \kWmv|{ũe"l>K6v.v#`~+f3ZtQ'I}{cS1Yq1{Gc]ש)7+\eV)(^}x5 k{SP`|-Y:>BX=x#D7_kˡ%=g{=G P /ɀEt|fA1Mh/Dp*> ^Q0h >vpT.h2EQJ}R*pX))( Q@$(Q5UvQS6w2w&&ݤ@:=̽oWNWh<:ӧ %*:H}hjun溍sGx0[>2u&|[ *MG}^ӵ eOώʿ~}K`_GSǨT]y;zzO/ڎi-4Tr܀o?c\ON? ޣ_Wjvc ʥI>̦NcZSsY~5Ѐc}T^ җW?w[Xӵj[2HAi2#W$A%6& Q?˃8[)0ȠjHh'[WC `ey* HX ReRCV^Tr bda6pJ4zHAdW2!,]$W.T`aa@T`?c>;uA>Ppe6}eo.<>* ltL2i 1< @w*ڽn贝7gkGyД.•?ۄ5z|?U퀶n1OV?ˆܩU6O|bl6}W8QS RݤnkI *@~G?ݺ[ˎYD0H)7䨮ʂDS|N'߱07DCHlPSbtuQi pEzz] /ziRE$TVD AȠ6 TAD*EG 7D@2#S.8TŐi$P.ǔ #A$;1ڻb3/]y08ԽGci,n%孭;ݧF"|1Գǚ_D̍SQ.^;7t.hyY٢+龏O>sV'_UUZ ^qWכʛŭCFq6I uσEI{vQ{[%LqpHAK]2]/ofCO1y+#|)KaI4̍j.L-bGY8'M=jݬ w{5}N'|^Vv4hZcTmZ[i~z5Ol.Z-4p{K4BC&թn\`ؽ3Sv/*Ԓi=}#F*Ƞ٦(J.4TĕYAETUU%V, !X$ҤNn6I?Z)cf7|1yBOCԊaZJSH`rF(Sxѻ5H9dʖ)2FހY"s{N2?lgQu9ퟕ[QKA%E", W3L"ʢIUXcTABcfS``EAb$eAR,M$1iBE$Xc%jYd 갨b`!mɤ W$&e AQbcP,AI%E%J%I4ft:HcUV-ji*bJKECRժWk*M22fa3K@6k!V Ei*ً6I4昢j>Ä}/;~xݾS0A;v $wmC\|݌mT,6Wɔݺ~OָKmD !0uScs`]I$Z_o{?ogcG*G⳴U" &8*\3": `/}1PYQTMp%@~C 2 DP!PKa"(:C(DsAu`hc3к7cX1>]^8h[wHnޒ2v*Q9z{"})]wIrr[ kmOzx6~? 5X&̖ERN 2 " "!.rgND`Y{{td:*s[K`i^A۸{OfcSG(nN֌6KmCۚߜuN")Vf("*/c$q7f]oس$oՈJ=5z ʏT*YE0 xgae?hϣ23wj! `$xFXE[h6ZƖՕ*V 1XDJ$έ8JWa6_~;spo2ߴ[xs箛^vz#?s;Ji9‥IEE 8y!^0/EM|}=,EXu!るA-6zkX_"?Os ""dm[Z*!hX-ĢJ(QbхIb ʕYJU,V(UA(ȵAJUH-JkkTCj&\sy}~ļ@6%eQq@`^ oLSd2Qi7X_5^/vЈU0]?fvM=|n^=<xs3NB*oz*e\koc>*NzCW2X)>{][yv~PbcMNЅcq0|g׶N x x[c}n[)c\o+Rv~m8?"{M 3C Suyv>71|Eu&Si:7vRוVq8OijU"'#mQXv&3g.}J w0"?1D* @ Eh*7DbT[ }P**ȡ"TQ~d/ ʂT*vBҊxSJD P9xo] ` ff byD:*Y>wCkc*&-FLӴnn+Իv/Q]5LuzH׽Su踿+Uǡ2#U_EU&0U Rc(pt~? q,e0{>G=ntӍ(,v?3P;]uQ&#j͵B4"u[5pb38_>v㟤y,!?8]ӱz{Z |H!%_b†SGn~0dY+QbB" P?EeeJ{(i@4$`AЮ]+c37-&i]knZ0֪=ƕ10+]PZ6$DH J#XX(1ȪD@P(QVKlH(J2U( mI!X"H-V"JJ/cO>_ͼd_;fx;/ETKa)"n c~CC<[]WDVFcU?Ҹ'O!:9*KR(c< UK h~.PAKA=ta j@v Z_ $T.LV4oQLa &("? H_iV"E5 :m}|4zbقXx i )K5߇~m9go=-ϱ9S@vVG~$|L=>ž+р m$oFH.X~V6=É~.w4 МÓً=&Oq*i9l*c$Ab f2UtT uTwe? {E쭵Wd!&ѳXZwcDNjd کq>;ӳZ)Bb)B&E@0@³ bI\^Yb1W,)A>t+%z_{@dPFECvB^2B u^町H~JtF0}zv1P:DCz" ϥ^2 !QDBoJ ְ?G>!#M+jVHn;i ΃πx$)pr)!mm_*×Rua_]ρƮ!x7[KIho}v3hМx7Owz>|ɥ ėKgҺk e G3`I,>%1GʮcG&5 xܝ?6ܛ6Lm-`b;_iOɏESuHKQ6@@Eܦ8(1K ("˯*Z+Pmy߯H[U=&<,(yCe`]({*DuetW}kQ@_MNjvv1Wf_"+؞wuF5kCc#{sV7>O rj2AȸZu.SQ06o۟}}\]= \5Ny*f|@Wغ*f *][E7Q 6 EO鲀kb B˂d YAZTD=^(37L&vgV뼛vzRO|SkMkcS~_, 3H q@[+WK=Gߎh.U7=Oa8;=F]J\K3-bs!V}Ե^K4&O:Ǹhh?J6vZac?+4D@#s@+t-խ>fa$^~!!wPQ\8UR(Ԃ!-5X_H)x"A~LU4aKQ[ ?>tنP  ̑CKz24#:A-Lr]qX|˰}zOΥerRdvهjNfe@"z*^ fFu_oiMW!eAbboznnlVInuJ%߷Ћ#6Gܠ8{76pm$s,f6O~!0§Tvv.?[1(' *B/ f`(2 Ddl1w"2+\W}2*.t梾CzzH>P^-*# !e*d˪2V@ dfNS? +5$B/YcpCo4I=Hf_f!Pw+{+xDҽUwk5J4 }m-/L!SnZՅP|"ē=G#KteQm& :6RP: K)V]0wSFUyI?s4 B\(Jqu-SvS&<\k9/{j\dw;O-2bd~ݵ}D$dl y6}Rzȋ^X.:ԳW`k"!&!9/{UMT@ 2/b_}qZ%ָZ0A/ꮅ4{ 3y$.@݇{Ϗ;8r_䎛[-K2oCb};wأ.Mܺk}FYbrp=+ n"^n.'^o&tG-_uksC?gg\=vQLخm?Zufrʎbg;INgm`Hud30fO\\̚ium=81ҟ+bK]˘4P`.֨~س-aQQx(g"]mۣfCbhDb2 8a48]7SZne.ދ!\AvqΎWcEQF6exew-'(93|3%NWaM۬΋vmSL%XهxLQ1wCS&r v]|<>wqrT:: U"q>GːN0=,* 9D S>-֜X>,\Y!{.8cWjx?+y:(yns0Aq1e҉r|  [l>N( yQ,!"!+ z:&ީ>cFYhj`dG6#m nLś`e^\PW)E=vjV.h% >)񣢑o޸w!@n瘃*C.^v_;{=^tU}y5Mmѐuz^G^ܮ}~M$'}}`uj/!oՀtJA~dYw SG?Βd%2nn$1@`( 8v~)U6[Wi󙍦=οb$UA]h>ܻ\o>t,`C-yty?u=) qB E%Y C1@@KhDT?hPD `@^ 0,QD,VDrGX_ǠoG"݀ۿ] &rK%IW3y5vNټ zjZ͒ r]nSP@Qܷ/\!B%GRI1}X] I5@ͪE ^qoBDAWlD2&|(@\^"eTz,#gOpڑA\T .Ov+%,Z^;"/;~ZgT)!Cǵ"х<{3&R d@ NrM M:%SV;v2 LTHD 3aDdSS80MMxMԭ~_|Ok_ɑWv[fb':Dc#(GƬT@d `]a.%ݏ7@W1e;y:oy~ '[+h Z(-Dw|lu(*e B"L “m575{:4L^ ?O_b2Ӳù Z"R"|?!S Ua8_NmgJ'VM 'KRa꫒}1~Yw[;;e+y{g ́K^h"` ̀ N؁n0,@>}Wm 8ϵ'Q #AyOTRQhڀ_C*O/"^M-Q[Q F}^o;WYӎ,S9{/+^]Ҙ>ng:V덳kj dc ĤFθu9&!#&cM}JϩUe9w߽醔hƻRe}!1^LK|nɼ{_<vɈ|WU*4JQ("m4vԻud(9Iá)"b@1pd /i;rPIPԓ^ "U²mJ*d30=Zޝ9ٜ3 ];3sz G ޚX@~"%+nt\%\PN4i ߣĔk StyJsA Ƞ)RRE׺ȋjtFJ.2VfeOn+c1Ciޭnדp=עtڪZGaANO.s9۬qB,,IS-6<`NI<_7Ȃ8ZSW;;trf?1QZF $g SX&2~^mZ|i}\WͥDā%I?GRHo}kxeW;5}o?\'CHT &X1Պ6€,%A2#9PЩ Nx6[J{re+聬љɌ| L֜^R}Tҁqyׅb[!8VA^)!"(EZ m_YP/d\Yls@A'oEe'#~\zsGVCIҥ!U HB.Ux1Pm tY :32 (w)H$ A<>_x.;*=:p:S,ݯW̆x,Pc[7,`! $+ = )y+o4܀_cz33aކP H.( `T$;N?VH@էՓ a afQEY$*4^ YM( U  uȹ0 q\Nχ1u?&6  rGlorI|yG`1joM02BZVAwU+P"6+txn6/b:OШx2=Zc&yl3$c'`%3n:x!'9K.QoO'Rr|?HȈ6(q(DͬLq@kDQysz[>`Zͳx63M1#L~c .q>|(;mԣ8jgi ulℊc4K $ .0zB#Сl)s +@ iN߳G5{G/<q:;>aӠ.f؜,VDqlbD7ȍvjNdk<(yߓaʶhmєZZ]Z=fOvpAo.✎@÷RdR8m@* =HG~>dSQW|ӴkЀ3 )t!cg(#1_/Sr1o1` 8!^cٲ5; -@bD?tiH9(uck("3o3Tn<(x'eAn멿c!jv Zh Bwd\F_8s͵ZXq3(󢃌zjg}3^7ү*t'^ * [ny0|a _,׽h`=G g]w)JA\Cf Q` TQT5qbrɾ!F߷Uk$/U@˝8X q(mଡ଼]QI wU2:DG"2PӅ }{龪;?d4{^e2ȸLɁsG.i.eRj(n_~ 6x'BiFL7ȾyX/˱3!+Q:QqvOOepv<03 (wd~Eb۩ն=bp|+f+?:?Ao]2(uUӛR&~Z' ׋FJ(vztntqnT&b.e\W1[hܚxh:o<9Yޘ؇YnT°FՂ>&M-W~3wbk!=Jyn$Wk|!NksKZrU]i{  ݡdW{˱ C6RGkSk:hڗCәJ7 eC@ΑOG :w;~M~C Hg"S+!ulsήꉜ Y9 4S~J(M0D$D/%w·6-\6)j+C%Q'g˿!9VqhKji"}Hi"]k;H^}Bos;q6~R97's K)9ؚwZjiT=6 W5ا%H SLZf!x*^aԨUInΌ ;u \w] I !93_6 gжUg HQv =A$FX_ش p5dj1ƹ7lJM)K4£ sJf z\kv7BMmnlqZd1UQseo ֙G%9rZdg^w1MaT UBez,:J | ##~O=ij(t2=I" 3f=;5%ڣUrHPIWXUPeO$Ckԍn3WQT$BxzfDF^4~v+c@ ۶@6MXYuW:e|UG}$^ܱDkLeeC ;F[pmFӼs5wl#7 rCU)ז/b٠ "]XhϧueP{v[XZ7B4~SyV ,/|EzEWQxpxc cP MMT ]"$NQn榗gi/&V4t*fGCy{%-j5Q|5շK?'C@qW~&O?e>.z6`ftZ,uX9*[gR9M+KK@Sp*k-krcqrw3q0B#`DOh|UM}%PO 1vtKNTbҗ1C@(to [W{~q?2[Q-}/d, ]Fk>usOjOo&6ܗϫ;B"Q DVVv:ְbԆwҫv̼}v㗿"!Se z*n2/YDcTH?(Xīi} j8f?z0Є첚Ȇ6Q8AH O@a:܁YgNDSdg>Zw^Bzr0g@($0&D/=w;%kd:%E\џ_͛Z#5> ^])5TZ#tQe.E8[Cah34ioNN*Z[u$^{S#SzV ޜ|/櫱]U(HwgT%÷C{w7sto4c5jm5JZ)$|>*=gzNڿ=:f b/8x[{Akhq`DLUJe h `Ґӷz׋8_;cW.Kj?_OBKt$d $V, ) 3ey*p.;˗c [ a`ʥm5ϵC MD|bؚ`6dpWb@mq/.1–Ba@>d pmD<ToeG*7!2zba/kb$3 g#q-wz$/cR}hDZ/N*N o(yVnW;RMOÜU r9/_6F}򢖥Y P118l=m&[ >IK"zT87[#o$o8G:TRt'C d;Ra2W *CFCr( bѠ(kTܟ%[)̠Q#֑kT+-(: <^$n|vCBWOC BU4q-p |uXOe4Bئ\b !"AKmJn2}*hM}a7F՘q2`җ){}ƛ>>Ȟi?( _??ěY2GK4aD/1sH:Ѥ9EڗBE?zv7wO=%×]9jim/ZA_]e蔢:Je\~A_sɒNo?#>ެ/j"(v{c>8?zV|zqNTFi OÊww7;D03*TFA0sthv3=,3Okx* d2`&V2[Socneb)}O+ &cX]o6SR]5-!m>Gg0{y5@6znlpm( މjYZ&Pl?ĶEk :ѐ{[k:_{;[8ϯmKY;MOo\ =>ž]5u]>&`^_@Mx?#G 7I W\-c5]W R*JK hc!7,!留c h0k 뭒-vCxg'eNнf9csmLW[T)6j^ %|iߙzE 8/Lb !\uI+8tdn  h@W`LvVɖTٷ'cP@Kϸ[B%AC &` M K?JeEyw>%q)*H$x7Cs񱻚_Rn'~لD2 Uay)"POq8a wn5}/x~䯥Bwj-<WȀ1DEB Qau`[H~Y8/Y gU J\0 I>:r~3[US?((|=Pr{J@i0}gptvu1H&lgJ_?1?lܡz3S$>_$$@l.z0j/+H"f`\v#4$ o[@ ~f 1}~ۅBY{f74kBʘL))I`a]N}Z%sПUD@]ԝɽx| 9vhtsr.m,w||W!,0OUܲDKU Q " lR&! B_%+!d:&H<̈́23`L:G*Ud"U=13NŻcTMjb<6{[HdL2ϛ KI6 b s rRIpF4{ov& _1HӗXlfqS(Tk_2`"|=P!M5 ;6i * ˌΑkҟ?X}ȳ:Ҹmd(xjKފX&*o\;fj-c?_crǒM?0E70ff,ؿjR `'ڍt|,O/'ωmG*{!B'ravmU+IiyZ[ @m\ts3>mEOۛϽLn;qK7Hbs(`찮䲄Y&A(@(KNܔHD!@B &*(f:)]\^@PZKMіZ#;l@(,*A %Cb&מ|z2E2TsmW IāF]Vc̵ј,])V˫{”Tǁ)gH\]tW0ˎ֓_&FaE9N_)/ecO 4( >rȬRBK'̆yִݠ΅ڏ _bG eEfݴA͢ .b X I)#~1egr2e>oGߨOknJvUB i' 11ʼ|9lerhvS^fPwPa*Ҫh]#g5@5)[̪E,d 3'ĚgV*@b/52Ԋ6[Ng3K~V ,ϲFpAo#n' 8Xa\i2$}TbtbiR,ɞyR @<8u\6+"dAEE&%D,kMŁv)B5MkTZ\.!ou{i e}f>%efB!\p !:=E$ T_kY4{tN';4H"JZ6¤-}ݪ4pt Wd0R5li;![dQFcI$]]o)[FwZŇBQ7BZg iJU*IHETV m⮲=vb2cj]c#\@dbĢ501eUR&Y`tet|>okXg.6l -ѥ:W6"x %ib.#''sK_v Q+$K@:t47W_[)o0`F &ft 8 1paeW 9k3Y!MNnHph[lc \mg[sjdRUC*Nrj^(\lC\,j؟E('lɅAgX-Tel]>m#)n{*] TY3~]􏡃P-n]KMzA #XP~"rz6A W! 5̎&Z"9B 4 `<Iugokeיs5>r*G0iG@H[Y!,4pͬZxodTu h'@Z |ށrO=}j9rTIb9NCVy !J.slL;WdL )qۃWvy|X0T-<"Ye\uOo:rXQ>33?ն;uH0EGIZS^F%‚5g3daN5_n8,p# tz۔c8.lqxF |Ӑ0GȒlWnё$ooݾH/C+\͓͘P@`SJ2F(>5@Vqb_}FͶpqll!>E|oMkMv$ꟅɮcYwad=qۻ@8A תmb{e\wzCu' fcVjM$DBϨKSr4*}/-?s#…&F.?~Z׵՗ƄajHwrڍw(sXa@7f!R,4(H‰H^/Yvzwf(/MX9<'෬uMC!{:+ɐ?\v"PkuH:p./6'MDؠ 7n_"Mݦ{srb"w:zeGÊ75.["62S(܁(xI40V#P Wvq@>G)/3;6!i a1ϩŇS="dup6h+C& 3mb!;9e2w3S7wTB3 .`Al ] -Z=P$Fl$,9JbLCNOu\o~hOom۾CtqT@Z΁h&8$SR+gkrfbנEC4=BtOKz)B$m{aEI@Kͺ䫒_n7re$] qFSS޵)c+ӳcI. 䏐\SF9\ocpu8+or~v}2UzF" NMa3t2DC%H`FiX,;[%=(Xʣl=)Ǩw[?~k#ܸ>9oWζxZ%\mo3x1-0l tOGskŭj߃ }Cљxe8ާsҜL VhYr<ҩ~A X1t4ٺ1b~ϸmup}oQnqM/pcZ70JkVyU7VL=q/ 0brf| tÙq<> |܆R8$˹8;ߟ$- LFaBU`AI,(S+*TR>jcH%zsdY /kρ4⠢T ~W"~]rv*Y6!&@<bKu7̍-)>ӕC^ʩ#aQ Ghi3 a8$ۀKU^J! a)І48Z8Z0Ws[PabEU&SXŊ 5UmuqM+зJ }K q9H̾7,S)ɪ q))媶,nNg;$"P(~cGAV6ՔukJ (D epMc8d q9lZ]Y0>}.}%YS BH_8_Ab^?D++p5 gk?n~7 ׼q XgXO}zrjM6Dg| 7zlrn6i2WVÊuǽub?H ƛpBiJ$wy ]Z~#~5m6al:m/⤙T BeADz=hċ́~Xw]Oω@w:iY^`Hg~˾_50|XJL\@utA!q(6z_1uUE.<(b!w,c$t%!ɐLZG Y>ml_)MBߒJsC0!d5uLWDTRjP e ASCtId}wjn6f/Τ$ PTC|Rbi,VwWıSlk4R<=ژ/pJ_0-s9QUAMrHvٜoXГI 7'jTFZ99âJBXUvx=ued2$#d' :㸠J P$8^q‡KdK ~ |Dʼn&^ObӤW6FӤ;TYrAȃ63ԷXvTYϭك48AB~'P7UhZ :y?_TU,曕 14,ZYQ (DN>& 8 DRr;|]' otzX*ȮuoYp,q8Vr3:h 7 c~BbVa˵zt e'GFtqo1z^XR,J#h= (Df[\0ϓN{ ]mgi{~e|fQ,T Tr-$ZL.T5 ypp{ X<0WcU?ˎc,+L-:;DI{>Ң#2!$TD3uCsnц=;:]Pxu#k2rQð^z#þEJy M4}ѨbV?J^wZo6g{=YgL 7BN.˒KϵW\[IXE߼rP5z5>~c?W7G| f,Sc ۟V1̷EY:ӻ8= ԂPlUU)[T`dd3E홄 6 bp,a9'f;wE&o6G 1ʑ2AO)+9P1b  U@R[dNlsY50hq @F+e !=.OWG =Sa>Cܓӵ-IF-ͤ[ WUq`=e$` r# IύqZ [x,t"8 䕁*)uDcaщ{7{n+N{qH`FѭEz-{7펆]FkIhHҝ 06`FAz'xW-Șhϱ.nE _=`Vd!0h:T<N8 P9y3";)Vj`֍< )>J1~)DpuC,ywʧ hD7TNmFݸb2璘UY;w*C1. UqrG4KMhkTu̧]DI +XOޔ ̞ \=\( Ov~=:Ẳ"""+bzy`l]=gƮٱeMQE{ȼ׀]7pbb+PIC];WGn[G <V*:FL&0=[iJD2YkeuծWdUY*"4up|'GjwkIO`Z)͜r[ [BA@QO,IJ[y٢ޮg؃)Df_jhVH" }P>}lmw|Xu#n40Q R^Z:2oU ~P v9+[2o{O[W:z1;;Bi*0$H)AQ$d m+ -y9=碈7saeb3઱pf-C>r#xGAIhՄS-e6x31۝ ̀G~0 wx6چƧ- W.8! U 9OV*9/q@PΊ_shcd񱖜M.H Dބ6i,$s)9%Qoe'dJBl][D! H3o{dmn4pqol>lO>|![ϱ(~C<ԯc, ܰx$I dafB [JwFsAKAT !uVf3JbT6GkL4mzZ|woy.FfVO9魶k5[CWC-dU^,iC:dqNJ}+p$6St-NZU q޻6ӻ-u@v1s8NV( }0`yPWz|a˅!,ndCka6 "3q8:䮿-.XƼYgTa׋V.l[I֢՛ؓ~)0d@%h0ɳ;-h3B;7aJ!AQɺ\[`4ducl?etDS<.v4șIRX,&׿} 4>OwVMӡB~}/?,R>u8ˆ<&jk'?.c9 s>6<ɭǜy1hs/tvbT${U0k(Rةnչz`Š<mᶙŎ ؠJ)3YEV c^u3W9{gP VM eՋ#_K_0oH1o]Jya|{Jώ>+Þ&7(>uhҰ[fQ̱6utd¸XTľlH*?gܘZKcv8_#!Y`4ZGjm;vaomi:P@4L[P~]QL8֪|Jtc)V>o&zo7IUR5ݲ/sɇCw?ariR\ b0MZEOη[KL$5M!ٵloVv6e'rkLN_bcq3F$RoyA!MClR3C}7}uEiA24gz2[ BG{o~wpQ >?1/MׯmKM̄đ8 ,+Wk3eUi|M X)mw%׸j/jz;XrgSޜU﫽7e R5W^*:@0lHs@/W\_#+,8Y(yl[X9O`H@*B/(<o}*DWq^׬dVtu}<|2sdhYN(⧩h4m80\= d@! KNאH-dQT]\ G>׺IZryێLZpN4-(=?z\L}~4Gȡ{QWȇ=2jPU/X3YN޴E4WTM @* 7쨣~\{Z$c\%.R?;9HQ x"!ƕoAJtaR_QwسKq[Y>hzj5*Ԡ Yc}cfb1A l{:C n |J?ma̿6h~eo` =VCEq'C;(B"-H"soY7j[Ԗ~zMc%e9,?VP3>EUP b  - hz՝}n-[0:C\& AZ'q23ͷj. ɭ_226euRv"\ #BenL*L\;=QAXQLoK(Q_~ٱ $N185UvAr Ȓ2Į t!u̷'sFE`,9mNs.ԯ@''RN0 I 劬 E& `9֡Vy9D`"GSbIW W0Fr=GlӃ|S^M35_.v!MʲCY]&DfR)rTA+WD&0^~[̚lvh1وImAY`iXz~yH0 U]X!TY-D@x|?-FPjJXQhR&0#2˻}܀ q$Rqh_xъG~5A+(U_݈^E_Q k(_J_/T o(Y5 +agiG`X_3fK ET*m6ŰeްLVZƍl o8RI2b4N"j@g n©B0:3:fB c#V|h_g ne7:l8LYsm}<٩(NSI%sDO܇Ȩоl=tvP,@+\K0KJ:K6G%0 w)娥kd4+Hl+Sh1apX[qYY͡1XrC&l6'a԰C#{?.ʓ~@^)K&jteRXUL:,Y ]>d7Na7T1@X4ύԝ9X ҅@HJZ%p] cdU3L-`B:5ô9W'$;8ݟTTExn69^'*=œI1#w3hųE-k.3;}a tF:wqi(UģbLT4U,Y\."iہCrl{hGc~aK*4^#lK"Vd# X End0$d d ]<RV!tȣDCtyӳ-a @T,(;E1Z;(3!ݱ*"6imb˯2Ya0|1P k-@}mX22k@nbnʗ6*j=riї?OI^1#l꺌dA`P\p@c24 %!P7Q ". J"^F=R'&ՠ O۝00\Gmd}Wۙih)gHP=eLOe7*Zm~s˜_! +HoBD$n8ϖgdw!Fܒ7j9\KSO(g "jE@V8[.:^mHN?3c:ݻ*SQ"䜂9˓On83`>aI̯ .:7Q7TQ1e90;W߼Nzi[OaVڣ^o*2aSI4}7g} p'[&-UڮT;djR64s0֘t@F7T~0/ ȟG(H%&~~l,܆3I(>ҁ7/ /\~l$zv*,(=!,L#~ &)poGӀo-͑9C4@GNA7^S] ٧#M5PE?ЅtW_WU_S3x«Ïi,`VntmZuC S$$?ZLõ rt+ OACXJFdbRi8p֩o;n`nV~ּɁ߁/"J.sA=\z_N#eD4HJB7o|&D q  AċHKˢ/ o|",k#{/OB,jU'yx)ďgw'_>XV^2"LrΦ,ώ\/ӕ4~R %A(j?yz?QA;];_:on\4UZ$M$0)IײȀy2bJףuZT:򠛖b4& 6L B&tX抣B(vKI$jep|΄ТQE & \hkiR4kĈ+ĵY.US"8C $z-8r@7s*OE.y]5,ڇJעȫ27<+X ˀ4lOB%I݅Axw&ku+f@$DNS)4#Q#P!B yd Lw an 7݃&&Y G*dYkR&dC kfSc˶zy)yeZka\I!k N"ӊC],#f1=WFZ 9k'߿ϔNzOZhn/dEk[޷&{Z})U9CJ56&խ::{*i @ cn"rP1 AJH!D$!<1ˋXØ#UbzrS]UVvX2 lVLע'"0X D#EVlxHM %@@Cý[&xdD8Ԡ8v+ t10+\AL P]D\CKtR`D=isC2@Z.! 9b\*3. r-@ Q2'Y@1M(Y%O)҂\t3L )s(5`P^IdgY:jf3U]e !r I M[I0"#LBC:n~m ]M=-f sZ,| xH{XӱXT76cF^`a\*rMQ=k몜3 3y#hP Y3%vz(R }QR}Oډ­K:W6  Dk;o3x|exk:t1YbV\]/Ro-Xh&,2ZWAPc9gW|ϴl?GΟ:-ނn(wG͎bHxEk>.@ Uʨ|o㮿0bTs(R$^v wgy& bȁ+F)TzѭS?ygN\av2`akC2((CA="zq9U_ON@P(b>eI+#@0( T%a`,H xm2ک7rʲ1f DQh +$X DQ-EEE RQ`ʐX,!`)0H# g*8絡ҬcqE*bU,R- T-vf`{ b`Eɳ8iHH IYb-,2[@ )wCVCe|e!&%9 DeK,X$$M#4"2i$c#XZc -,VUi Y)ek{Lݍ"&ȅ] e4R2PfiI fwW~_䮟ŗK:L gPh!{-;C4NޮVLEfWXz̞Wj`w{[a8y,ple@RZn))RXTF8ժ-+@!U%bM-_:׺ $/ڱPz-dM"i2Matb(,ʆK3f9)2 77OvP#Me!(&m%b;X͈{A1¥N6HbHL'[5X:(Us՚[F!m%آ*YU_JmIk9޼)ob{]/;'4E#G:S8(vR~??Iqݵ$"! "*(DdbHH  `: E(,aPYaF#T@EDB)0RQV Ҟ̳ۤ::ͼljz, ȈB=L$ "aHė *1`B"%eEd+!FTQF*F "aH `-;H%D$š0%X#cAQ`Ŋ !°P`H zL 0ᕖqTY!HpRZET&SY(  AI /z`vY˾K>S6WZɷE+"Dqy$B][w14%\UCЃ챑aICi8m{ !IbȣEYX( AAU`15 d FHĀ 2N G2ABȁTQ/ VHO`da X.L"$#K&H2ҀQ$JQeZȑE>E0AɂA0UH1 %,3,Y%e-!a2TXlVLB!YX[=o6Zl \<Y.HDBAD:`aM$ꎠlIM  RV10`}n:n<e݊)-Y)s3-[ 4!A;_GB$G<{WU>mIQ(%sbȉ}gX>Oa!;nG)CpmO}WIgE%B5ӳjr__ïl `L|C_NIf`Ф;&ŷ5\t{̧k/e!oRR @ XG9zB .,uK AN#jڢ2'8J IP{DUVvŴho p &# @(m_BP?W=G4r]UlL@p ?A#WM\V弎R#hȅl`غ `_)҅fE! ^tLvPtR>J"Kv5BBKRCs3eX?Sn`"$*YGIqyg6$.9$ 1 эkab@6~kϠq_ٱF\Sp?R2={偍Ċ!E zPf%%ܸH 0H[ERIRܘ&P 3Cv1e\4:@px58!hEf`$k\Y8-TԐ,'A_ }. U@b. )rB,ɬ/-G:_Jc)srŢ xQOh@ޠC``"D*Ŋ}_BA?2\P^ W0OHK ˣ^,ȇ7K3*oM%  #jmmy6,;\*MQb$Rr c0-,,:(piŬZD"A0*P ~w$peHFw@ [)Jk.KSi֡˿M MF8@Tx 9 qpB["셠v!qfcg&ߓ9%D}< 9eKD!h{Y9m,!l6+JZ]jb~7 6` k,_*i66(h6,\08dΟ|'~,9$SMPmpB g^nTlU->|mc'3icAu d,mXt"RA$Af&}L<<d!V `d7m;3=@k]*ER(߮p!r0LL;ݔ1'89( AP f7Q@(=2-N'h??__ݨE_Y%x S̓g՘*m]xK=ysLO5') =Ơq"4H/K>E1ȵHH \7unp+5kLO.v= 'Zp<~C6cfDj¢Ph_nW0CEzDͺX< ⇰ 5CyKO9OILZj5Ε$K3<؅DQ6Dۅ&nf9i Ug&ZbPB"ZP($`hdBMs|;Y>pwOMnEO-5%y/Cnw\88M(,Jz݇'^i~5;%&A߇4ViZsuV˘Ш|݌wr<$>DO>ig,_^ϖ΁jq,{y{__^_dL4d$;<eJ^k˓9poKzZebLhbW_^~O]cQjJq{(* dovm W$d#D0!?^d\[ٸDgtS @7pxX /dr2i[CRԛ~,7Tpvx"/!u%-'2|Zo5ox떧ߛcrwvQ?5 j66m4x2C,#>$E,Q- r F\1d !%EWi'ay_XY RH fYA|k}wN1sG=%vӌ7uiv}{tyY#O|N/vO 񼗴\+A#$M!*,47-!FNR%oh3sצ{{k?ӯؿFDN 4ʠnP:1CHd˴Tlm2Ȥ>Li5&y7+!~tKn}^ϭ%7b,`ŐwD30He`}ҷ:GFk9Mex&GgU |D8Q\nù~fH hYQro?'A'HP$Q"1ĎBb, ! !I 1T >Z H DQ* DJ"БEmBDZj -P%V" 4Dz@@6>Ml (MRPPRB)hRE 2c hh "&>tUG'^AsdFJE (T.qHR4-v\3 @r\̑A{1J)Enm,A(ʤ$)$iBHc)%,dA I3%a1 c$R( #l 6P AH0 ]BK2V@RA) dYf@Hf+$)#IRi²!SXX`ɤj@֊BJP Ll Q@R a{0D!zt1Ѫ׎c3|PT4ڌzW6yxrp1z޷&N*tx_@ѮsF>- Jʊ71,TA w;&5"j7YkxdB#D`kYw?C `weXԿ/}H|l `'8~=$m., zR/:HB ٲcɚt Lw55FE4 4.O*ŐCZ7ѰN^`1$8q=)[ 2%*]s9nB0 v0re-kB>DS * h&ﵠ]SN6c"].|CSevV5}k\] ;JLS-1(u-P)AVׇchN- (دoss4!23 7/JYC"+&:P# ^8(zSQB/>gI=]mKmuQ W e_٘L =IeeRxm@xjsdmaVC*l~i΃T;jt)(r 0KfB0ɭ:~opԦm Qf&&eLIgg_Co0Gk1E}rٰa~Sj3޶s:fן~3Kڑ)bȚB:Ty?3y RJ(uH&\idWwsgI9ҞU bs -_>I 8nwR6ªk[%K˱M6sLh(9-P$JiB7ݦ?bBN!rcwҥ4QJE!j'шC/lGkaM#*I+ D&Z3@5@Y$ 7Sn1o8nd},#sy>=vbܔwJ{5d9kn[‡ϐ|a&Ӈd-|qwx =@7 z^^xX7n[UH"=1@q v)bVMBAb.CUMgX R_/4߆kܹ߫DBS (4Vλt#LJ0Dt9k5PP-pAIВUP;GgvmӍmKiVZNk4qc W>M|ϙ\oLVLɫat1 e1+U<'dؐ2E_mI51=o)!{*xAn#hH9.0kZ9! Te 7U M]m^_Lb($8m-f _uv3߾4j=a rnnJV. eP,Ӗѭ.oU== UAؐcJ.ZƏnS lPn'w49)i9f Nu7 1R웾;METkX8ru` 9 sEtw=%-nK{[4Pp )x?ᒭL)7{ t w Jr-ڣrs,,,adTzV-Xh\PļtzCq8,vLPRv4#h*xD91`ݰ: 8`$* ӎL0 0''wS;1;6Y#U^:f#?aVjqJaz*i=e>՝zN8NOm+U>pQ:75f8:CY/>us(qThMg]12Wb,(QHڽ"%km؊WWB2J3ŬJXHQp0J osPR n?싈OfZ!yn]aC'l4<yd@)Q(̓a75Ks"KTQ @AX%WA}^\`5R'D%ꑅ$ 00#l000,K'n呿% c6$5 6:E Rj٥@5L,^ FWݶ4&vg;)%%Zo>TٷtoDz=G5nVm@mCKHHqGȖ\,ޢG|žTiIv!;aɘQAT]5}XՏ2jpeZʚDB깣R `aSE_M ZTXR_) V>,0 L ɑȈ?L9eۉ%fW"J9F=z9 kd4 @a[`E@qF\[bZGN?jQ1U1(my`Y-Ŗ\& JY4Z#O 1d T-5ɰ4Ҋb"Ea `Ń#4w+"7=Cs?:ZWo(dxXG (;Σy/!$̠xCFË: 1k6֋Z3 a *̸*(}oTP凧JA2(P NcpipE!ai,Ez{ UuP> LEQMbC GiZ:InP=d2+ls{2Kvvl.4Qg[잂W"~rB kKFtì7J#\m8s%ed"F.űV= *ol-01_u8BɂvX1U˟mh6pCv|Si`AGچ[M_wƱTBXH /r"/SyN5%T%ՙ|mH1 sgYiaoa=k3.v˭^HH7v/zϿZ)2#%DXIUVKs?;?-fijM  ^vuZ=E }7u9IvaXlY`F"p*@ɨ&gB\av(0!@ ;t0l+}Ll J &8}_0E?(u$9gAcvC[ظUa49 ni('}q:x8Arǫ&́B+VU+ 0H3$XMe|+q[`(Le1{@{7 b3&ge0e˟$Y؈$^" a?$itqZR5h}[t?7W?|zJLIV%B:&f~"ֈFnmv*#Gaej^ak`ĦڼfrBMrR -*to4ԹI'_Գ/cQ怨[b22 oa\~5lV9XwSQMpU;3;={]%u/p~Bĺ=}6hc!}F4A'>4m1P'\9ַOFu54ٶ7Vz* 6+'-f󋕆*v?=טΖÒĝ^\n?f+q gR@̆=R'?j,i9!~:g=16HO)UDc+i W<`ȩ]"nvT($cgF##2zFtϾTҞ/mzv`A3",97-8m;'}&J3ɋO,ZX xｗ%[ @: ynXZ8{zN WH $lߡ= tU$ǭYZu>ﯗw%+]2JY1*^քt2TӒrВi-ra#U4ie ?N-[Gr~ñ^Vԟ'SXR**|fA.I2Q\W8Ko<ԭwOeߜk=.3}cZu} )f7}yƫ2e]?cgv \=>{u^W!^?cyCJ~?e2̦BN$|{*׆^LeyAo$J6ADKZH SwD=fE$7̅*TUHczk( _mo-}agyt?mϽʭ9{iDt[ 44Us\%^,SKzn-7JT8d뗊EeTO)wgZN}`^A yC>)(˟,ww)#DLfm M1ImlȾcV,DQPU 0Vl.QUXъ)@C0ېp)w5{F#AVSU˜}tG&`:>贙JX(S?)+O}kÑ{ V';6?omnm)ft븶'is߼g4Yly@ Bwi)&Qٹ1Xlh, =F&V"Y֞UTyZww;Xcjt Rz*+gEi Cgp̵;ѳX,0q">v__,VӤ&Q).[g%2`@E "(XE" V"0P"BɘѵfA"ȨEE"*`T20A" X?PzsͅT$E4?c7B.f6mvwIcMXfܚFW?c鹿&3`⧋5@8>'QAwP: B;T$8,Gz]|י ;^e^Y͡ u 477h$ 9 K($PJ(\LfӖ"OK-e(~'yvo޿bcs8.n{_U.`)XsGf+HD(x9&NƉ@KxaۥKՒM|MrݟCS4AE3eAx}SV$T\MZ:*2B'pc,VKw9k6{ˋ}صFL=ә&+T!GJlqY,I-zpuTfH%|H*MtdR4߀Y0i?;o``^s!wM(A(}'jq˂ʪ(/:׼a(+a!- %-[_`pnXKNë,r1Fb҂M{t̠2FYA쾢!O?D^n͆˧lƖ2q7'BM Xnmp&K۴~=k~x6g-%, I"uV@N\&U Z2lA rC M&I;ί]x쳟{7rg8)+='uN}/ߍN"J![V_|h)!ldACd @T} l~i;Vh$X֛PT5F9U(Qg&Pb#M(?%3߅.tivaHBA(JA ~E>W^yZC9j>/?Ӆh?A7l:L.aB@d 3 $ew̘@q EW GfULs-~r[ZK$ ?hZ (Z@]F)n~ӭ7 k0X"8Rͫj^ᇸZqh(؀ϸOx||M}\_X~T(u*w.mREv!^PU4XyI x<($!ZABA؉]cGVx6:&; VrTv>?Fur7VS{}VHTk^˼VoW͈y0H ՚0P(Iu_GIzE_unƃt⬛~!9+mް"[1LJo_{ߺ/@2>Yo%JpXjXuDW H!`Ugjj7>?7˻#Ckһ:On:!|w Ps@ZMQYׁx+ հE NWb\T@!#˟d$Q.8 A? L*N/cXsB B>csj | b; K G;HgK5- &l,vOX]\]edH" h𸄷Z}{ ];^pM!& !NBQQt; |RsMQwYĩ+E f٭=s]$dU2!A'cV:"݊Tc(ޝ5 Dհ2 K@| o"[ j5QPVjJ"}7H0S|n?)һ`ldJR ZNb?@w"=jx9塥VYa,)@R,`nj A2]X#5uH3[Վ;١rDdUr@}M+4w/Pڀ8*/;9|^3/ f5[j^k^)1u>>82cs鑥\$rP appf֋ݚ΅F(RF Uؕ#Rj""5Rגmmޝ9]s.TjqJV].^yۉʙL՛mumh[ڔ`iMW7eqH0@GUi?^'Q@2~y.i>%Ξq}ZߚЂQ B l/o =%b]qޘ:Xvl/_M ?{[^otvZ g^% 1BO2Nٰ(Kx+Q1mxU^`1-=dšgx. T'rWq NF#V`/qVBbk6Qv!"Hk@!;]L 9dU(I]2E]<9n ZY E踃Qi*JT;p Pkm ͷ)3:t[mY'0PHke2b7Y˲v{^!v97UzZ湢P[ڶպo9B^ܴ\`"ga}` %SVm8%y !@Љ܈4A 4Q "3i{XIbs)Pd1d{6Tb~PM&Q3!$͋z!PA%B;1 %YZcv7ܻu8ꂧB8,,fsΰ /+ ,nQ+ %]+UBVSB,,xP8h-V95 e16WQ#K?FKCYP&i(1VJ urf0#/fN Msml 1f%T땉O(j;㐇)3Q19\ JJ BЬ2˅͓6=W̤."ܒ͔EYLX&-]){ͱS`s(L,l;B?P K@Ah///>"M5՞.lWӇuKr,j?KGXȵ&}]t/}A1Rt)$FP9%8]', O:z$hƨ!XN'xbgO^Q\J[jىU1RR a@:UUQ.B4izaϬգxm~E|`~k#5xؚ=@&j9M Z&54\N kr`zUѳ)nKΒ[\dgX1h3jD+!QTϡjxbַF6BrN1eܨu#U> WQg'nqr<]^0'>s t (+]+IG+mv-&įn= ~Wm˕棓ErV* r܂yȳɋS߾PUDkAݘ-lG;R{ x~b?X bPæ<7IF ÕΨf`RFdfgUm -z M*FN3C8w<)=t*c{iK(cu3 Af7~}v|zpHڭ\c*Ho3ƀ"n޳"_[|~K&/~+ Oa;Y,oIgz~d$ ;P4H3A!N]](WO0p:J=V\~{g?ū}C:ˏP6,^/;fv9 "=og7Bt4,?6dYj Q H&GKn=#ς\R~O9qdgTYE/0<cOMsjݎh:9hʒ T!R?Jܟ߽y77wdmh IP՚=?G|6ѬeP(.-QsqZ߃z @h=e#DJqNߍd K`w!|#1n y NP ,П)`!QGLdVG`E +T!m&p`_5rM`]A(FK^-(n0CIMդDYj-K\ ǔ?Cwlz?pYkwbLjH XF\?cY9'6.Zg _XOYd-T 9؏Ń \sVQzV9"Mr9}BGh̛ݷ"Jx/Vv(JpO̺@'}4H>sXi-nX(չg.L={ǘ0h\EL:v: Z&;XffV?M| -?꘢!8D2qcJi45;myL&3Ocy V~o^˽I[6dxx4It`?j^! z1jZ[g ~Wܮ+kܺ]\gn7eH4Q1M| *I@. V)Ea{x'RPx,2uT.LVNńM)8s#+uƾsF冸n[.ūz@!֥MP"^ =Y;[i#{(.RY)3{u c@8w-.-cosfjlͽ'7tS \{e!BnJ/y+ #ު\>X3:9m\ާ}cALEP%x߷5oWSU;溺; lF4sr%r<GځU~ Ѓ^/~ @АvN^A |˻1*hST4fr s^b G+K}&W#xȡ6p!k $DFD@ 9)n|Mk^7)w~F ƉH=;SE0,?J\'T+\YΒ 9Q1~ eTceo9 =uaɱtB]R9v ڼ̍2{o7tw_Tb3$)g^ :u~3vn6;~,'ҟ(1[{`){GnTO*$`4ʬxڙ)WIL0"\ͧ9Eb8t芷EP%};dZH]. }Y Gԉ(89ܷ9Q>j4P=M~n|0cI)#_c}?6tmJsh841}ej_[rƗ˚mzrf I4[W7+Hwޖk 1}7 )@SV,ȋP@$ V'GLQ|+# ]7KsTCYAF 7Q~5} Τ).2$9¼݌8́C^ɂֱ\d5j[(̔ J C]F5̬h03Pq0fdߨ2VUjz}^ `% YC==X[Q V"kunܵl?qm|wVQoUy$N=']˻u9_*>uvo5s峻ս'*W&~vLa+V;9#wjّmyd$~w*QʟSN|>7)FfBIB8{ʉBhOnoGy"A?u(ug$3{ M|q&h dq@dsgJwTzX HLg,ƤR #KJ 6^_&h ,TWk5Kvд hp, >ϱ4Tˊ[e]3aH!)c3hNњ;FBd&i,ZZMPς$f%SMpPS]CxSa,2\pgȷE[} P IŋPoYB*Dm4݌"ik55L +\w]A,[(&Tݤ?_#f,Tę39PO.JB^Yu푇+xcrS{58vWϺ18Ĵsxk6t2*浯YMoCՎ`.h[|c /1=vIt.^y߾O0 Wimth|P&.Y5U=S_Tq -D QPhaJrs ~o?{W./6MKk~WMټ>?8! zpqxh3s.A#(YN#yr l5(7guzcT"*ˁb2p&)WYYD!jQbU<4nQeO&d1C7jj/$M 4"@g[:V:CT(s[nX+7= f6r`U?ffĠUo;J =DQ ϖ}3Kp _7;vk= e ۶)*:zmXh \ \.hAŧCs$|T%qik gso$q< Ɍ^Іm59-k0v;33sJ_@ej藢j&CFP¢CA8%G Nk }AۄAKYyp8"fn7 !^tDI⤖0 'umĊ/IP :{6v=<~zs*gXevwኢpl&N'55r6ǣnO?qL2|+;xB˅-8 >wo{ Xfzw,=abe(cV'շK"Չrwxcj ͋ƅc ꢒ7;})39\wk3TS}U򅧮Z.,wlKY)ɗ;n< ȄW(~GX`RY)&$ZJnvu øRSb%&Ŏajߚj3? uWM}%nZ ig2Jw86 a>q9ߝo 6yĚxy=p\kܪ󛄲KWں`JLm6q`Wܵj\ Nf TiUQtvNkђ)!rS0+Y1!_ V[dnFF_MZxb`m9ݮ5 7%Tu6*ĝZPTK:ܭez6&?'-/OWL u:g_ȜMc6z'0ځ>#@g:xꍭX(2F2PF=ԤTVPEDA$K"dAc@>mGP{|$cJ"0dQA`VB c pn/)[~s?F`fdlo2wwXeۆ-{TI~GI"Q2(Yԥcg[ A#"H0@<Z",A(&Z,#Ex9|gGS(!!@&` Slѝ3 )v(e0m2qdBɖjUD;uog6&E3`m2DPXR噅[3)Js lR;g+ѤVhK,5) FY5wpWAU㷿Ô.BYX[əD2C GMM%efs(J1 BWەI8?p;I=fV3Y{_XM~b3U 2b,grD t%^,H+Ҭ$ 4H ᳩSU/'6QП6:3=6Gظ{?~W)-7 q5XO}i!E o 20_1[l량 bm@kx{׀ֹiJ"u7ӱ= ;Xk fHn35g/Ͷ/ =z)Uk" !*¿-5PzHkpJ4՜h#s XӟCvC[IȄ 01:[Nv|Nۮeަ[%s9^VeD<2\P! fq_zz"OS!3q{IC7&[L6[$ + `ߵv լN?[S(S;ypȆ:_ƲtCh#OH1?tJ] ˪[Bhؖf$Gsdk[xM>HC\|ò))mVolpʘr5.Ğ ;ib`.9kz),ӏ/;/ BŨ%m(_xa3;H6 tE,Hh/;V/2 tlEO|O}ӎ)\rtF:RR`Tef*l1XL3~1[,p4XRׄ-۹Y6 iXjGw<[`0 3RaW(Ӷ[ U#.[Rg8<(byﳃKc7|lPM({+ ײLJ 0fH: m 4 Wk*]iTU{?i,"/ZzɊ=}mCMEXy x)䝭mح{y&E`gA5Yv/C``+_STbWJ[G%e+0Y~~/y Jz{9h!.׈Ili ?}~a[sܻeb_#RJjny1XX()-`yQK{1bbP:.%ԭ,7 7Z1UPA|0;>j1NtTZ'SisU[Wos#ډ|Μ-7Ur abٍtlKB1Xa8ҦQ.JҰ{|ür~"N@8~N̚9{wEet:X`fުLd@w>AvLtݍ+`[Ofօl>9Y̫x%P{ST!✨3""sYgN2j; u\|aS-&٘ӅT:9z4\C@|6溧h 0IJ~Oѕہ@W?0t]NWcw Oc- YYW2~-LAL ,@6q ;nZBށփ3,%Y7۽mwQ-bken֤-[cB/VObkiNLDH d\)ͥ_^/;H)#*I-6a}- KM+MZ(a!0f\Ki0qq[mׯR - Zꮂ "Y,Lm:YYk<72̠ՒÊE]Y_"n؁<r=-TAi@,')YB8^|9ri-DŽYAV3ZXbG*XúK˘^&U~+Ch!|12یz져@k֟AӅٱYޢoGxiCQgPc {9.[=gjDܕ&j3&Ј(VbP-r1i F5z6kPVz, wL-+l{߄Wy167k_A [ߺA C #JR%OIG,*E Jw{27fA=/ϼSg(-u""U l 唀T*/5 ~O}+Gu>%6] 暄^_Ӑ6 p3!P9h4<*LgdiGvME&IE_CZnrVO&鍡@ D`jAPDke_>Y.+ -J`4 =_DI Z{icW^A,(ٌ eez76=^l+_hݕh۪X<- $&;Ϡ#@h"@24Țaq E(qدzc4pE5c"o)3,p{xGGÍM+7#گ ~̾=~}CPbWzW`~k3U/{:e+8p'wp0WEˢohb,Iʪĭ5@6.F4C=c ezxxV/z9q>M>|sN$p'/( W5$m uTOYvmq1HDkh)YoK7 Jr]Wݵj2YVBv:Hp}+h IplIo9]ʿ)zp=[ghV瘃U6TKs $S*رe>9Uv  $)#@<2 cI]w#<-XVZW㭒aog]+^ظhH uī4gbyt⁌XI6i=)KY a^fB*1E(ZoݑϹaq n+~CF}tb8wWi~3G Dv&ͭc99#W{Xd ۭyxf9ޓk}mϒӞa=IK7V(طTc#^7}6.k3 ee:[wQ(kagQ٨3ٚj/5Zu㓞Wʱ.ZJ>b:9(݊e=+Ф&@H. *'gnS__h=eJ.`f]o*Gz2YzP Rv{pT[%V`³J!q8y Gy?!s={7i`ygALCF3hrc7 Ն,(:}Iyb 2H'd2XYLfZܸU\a>پ~v}//';9G:iWĎ5ű|0HSI}dba\2+2cV$ABYNWG6bzL.eos^s`t<)F?Rv^[(9'' h@0`g66fъU_č14M5dS)}3%Sw?/ȟ(G~jʥ:PtB8~($*"c cr&- *%3&ދ16KY4+l;'h˶i(By(,Mc(Q˰ۏuuݏ_=ofi)s k,6c.J؍HaHWp_-{m_:Xo־4 _7N]wW#{qH#tл1zBG5irq]lQeb1*DCuF`Geik cL! @@FUy'yeeQQ$M46PXdz2 kDD2 9zZ/RӰIu8!~WIzv٭,3,}¶\)v7gY1<=;IQGH̃MZ"sя0S5>'zOX:=$fAdhuRב6163IBmahn4,^/1W&m5Gu*B^gcX6Ǭ)C-Ume8 6ZP %s@ &-͕TIٍ_k#3b0ΣVQXQ3S7ˎzȲB( $#!$ HN^OYxϲm;^ 6:ej  6'޺FNgNCښ ߴ4,d `1nn6`d zƽPOѕ2fY7~0zUբ(t> M* c6,!,\,aT={Ojfu`[b)u2`vG8T@(3K{P@ %4T)z>(r-mS j7림=ғkm5فٍqW(P@l8i6q$;D\5{8U^sv> nk-U,S-u88 L/A'[ ~YjV١<q1Pt\r9ݐ DL23 f֭ђ;1=ymfutݭ_L 1nBR*l1:d1el"K'vVujٌZ"„յ OUr"VXb`6dxXC# SBxLvw%B#CfH k[ uqۣ{t4Aշ<"i-iZ0fS[MCt2/KA2| ĿcmwDWq5b/L;XdcQB%G y3& wR*b\3B'x6o5΍} N[7K~923^6nQb{G|HHUfDR ?WZv_h}@(BfLj5o/`+l"ڂ2*G\:\ HW,,-ʕ#YW^ɂݯ:a0@0%H0&bM4h0f?k꺵^T* Ⱥ9 }]Oncn+P;??CSC,R}jUaVUeM۟?[\+WV@0W0@Fn[z*a?W=f;؝8lhdҚD!=nz5tM;Ov늘 3)zޟ/bB19)Hnw]&g'{-ߛpa}5+~B2-+^.iK}&10[4AX1vS-Vbu~9[!&UӖ(xkm8V4Eu{ bHc[Uojŏ7r:8;OǨ5'߹wzGz SYiJSsUFh47d>Ǚ 1G!0Bv^3w^!^`'Qi gnj]Bs7hlVi,=y6y/'ž_~brQvFyP"x vS,XtbT"C}o$'£y ﺱP Rj<*?j2"|9[dF^*$/w0E,+T*z\|s'n;ݛH0jP2iUqvZKpy{4]2'r2.ddgt *e`:DAhUW6C&|&0ds8Y]\JufJ \JZX\2"URMWEbI"yE+㱡g/߶LCJ'?w.CM=K]<_yn6&KѯWۀj\vTCvfRAk 4Rjތ ݣCCa$bqԝ7I6ھuR323's-`pj!-1E !%0* Ͻ'w#@+a}}**4|g [im AA"3&͍n}`KZ,| C#>  y'ta߰rs[hQ*ֲRЄBDR';g P7(5P^&f(K#Piژ/;$kVTm7ФSgV㾾ƨkJN͚9l HS= Z>%ӧyī0/W-S:P q''aUWԘy<~wfuMm>QEf{`8G_@0je!?o_g==jW;!ZZ0pcJSe1vE&׃[,\Җ,m&#_owdvyr{4Z+/"sW:gwݿ|ޤA* }_hm|Ȉxn.j#P}:i/w)~OV7=sxg٭pR~,5O*V |3w^-QSv`[+Ԅ4z ^sR:16OwTDb221;}%˛y$(IdY񖁇=eN`k1& EDN HVPI$X;n]! 2k4xnWN]ımsW]T\RWrPkg^Yhh[ݽs&Pl8BP"P U vaK:MnY,]CG! prHjᷬV֦^<-bBwl& T d2rDB\]K\[["_8P`ؙbH]E vgoUqTӂ^NܙsyML E]AZuQ= bʋ̹[^b5;7Ma@)( M 96kE8ld bG{mK `O>L|r.gC2FƕvamFnlY y:qOğ!Xxaզr]ye(@AznEbgbgk5ĚzYw $؇px|Y7KB۵3~Z~vKߚKؿsJ.\ų=/mh6aEY<92ƒ Oeۙy|mէCKTuG*cV$>iBQzsEp oMٔWoWH.H%AS&*qŲXAazqL 1 \uR *`vuAb}kDl if8/>t } j(?g!Ұ[V6lfc%wcnh\O̶M֊cv[d FO= <ɈRH$_Lx28ニH7b4 d|?}otTvuRR,D-WL ʹm~֨Ȩ"N;J+VJ &Fj.շ8u.m)vvvf JCCGy b8p7:/nhe:PWjYsm< o?^E<}Oj ϸmăP5eWiy<q8u+kiZ%O2: zNʨ 8Zxkta=G٘ <2/K2eXD*h=o|)])/~gq5=h~g_& ]F%F) %_j.ی_s>ڎE#"ݥgc4ȿӶ(  D|++jMz?Ag!Jce|NC^7WWN{1wl:pn7h_p?(=)f#Ѱyۥ)\M&UruOH 40I|baiF'r*+357ܜ$Bu bUGwA (b3`mրhayd0>K>vdEKEs˷պ߆1}}xQ.c<;^I+^<]u5U;R*P:8ʔ)Mz!Ys3wޯPe?[ OYR (=jY&UOvVG`bR 0(Ge^; ;,\5t-\DeA$3gZjwyM~xlMAwfkDywv<.EzA""M 4}QI"3>BD9z#+ ,nKK_}`:{Uzy}A&Pn6c<'15 $%8v> !9A.1_GfSi ,VkDNnr@@dp_##Gr`0?.tu&XjUL5Qx[*@$Lx ꨲ-. O |} Dѭ -UՆdwBwȷ/0y0W}7s  ;@.Xϐ$!k&À7LBOL9ovwRDU/{gH0Ҋb^MyL8oaʜkk5IőK !B/!uB؄"AfNjҶ`.cZYDf3E)r?'8p<߃n$`sJWCýc}Ϛ0=TR/! pאX6RsJ?jMGA+wF%y%:{Rx@euKI 4ǟ.Sd..`/Fͻ~׿^Gqԇ)vF}_ $#B zn)eco6v7|)ǁ jFwU+[r]Pqe3wCݺV#CAQyC~~_oC=6i^ԗSSel"Z"" ]TJ! (]Ғݦ4ZBɳVt]mX()uA0 \Z g̕ R< 8aJv074xrޙd.S rwTdIwKl jS,6v¶&5$/YVK"O i*odb3e#)#XM}Sw6ѥ5b1~hVxiG15DN+ jȉ&UϏ\+ d†XMQA!\!&L5Z9)L`4$4bKJe,nhѻ;Bw#.Ed9IJ#"Ѣ.V`d7fb5:7,cX*xLFML{x"&NPDA!!3 \X6HfJ:lIn³1XVNefX@%Xh 6ȂŘ$`b)ST=~jd=}뵕@5=4 G:)aZɣ]Z]7 j:X0(ki au"֠% \}k+(+e2k)jɹM9fd{`Ynm5.%wV% ˽ u03HQvCmMNFV1*o٘iw[% JͬD\L e&fԡZ]&հ{i)\9GUu<__Jkd?6Y8f ?G9 ·>cgRxnl/P?g aþ35kxEbHqfsAڕmsl:kO ȺIUu6^*K|ZxG .`xD"Tv\0W`ˠI(~#[7(i7G(I-v{馵*12X9-$F72X@YMϷ;G`)ê꫿4PlWc uedHRyh0o~ݼ]k ɆƐ`J@@ 3hgPRh䭀 PBBsՂrZgft8aSin\\Vv^ uq.S[˩bv*rI)"inio=P=8"Ĉ"D$/՟jjz>9j{W=}ߡs"혔`Q5s(vڣ6:XoO]oroWn[]E`@X$649kh-].ml>ؘ׹ߑk8л|}:Wl.hÖ-;[)"!JVWtV<)_"y *(cgbK2]jX4lQqQNIUĄ-I%1Hfg[ +-r+UnHHb) [[B옚 QeΒ\y/n\ˁ'r)ЇbZzuFjvwT`erP12CRa:63d%q,03S`64D,3ɴIhq%´$M/m)0q p%c`Ε2!0$!AAl0B,nc| UµcJ^)s2XheYvq %bDa XdEGU\k„Qf4WFي!`oj:;'5vaNd;Jﶻ2ӷiB PKtUƐD03\n҄%G[-L ;5mem6PR6z甤 $ Hqr-1 +hw-MbIVKmbE FNMxlDU@ O B"Hȳ(?25!E@ 7Yhd!fD\`'ԥñpd.I@h=L^7#2ۋo(4Da4,5vt8PNە CP/3w\=8kw]IDi\f8.Dv+Ǽ]9t+m,T}ٳDI 7Jкj;rw`JmsXghk[RwܤB$NV1"G-Kl;|2MQhw|eFЄ"iQrj7gc1 B{&3B C".$ B=z*_4y_xb܀I ,PH%/᠒Ø^= >nvnBIiOW~>?6DR(EXeEfa xmqUAm$JDPA% >Ǻj֍ 3HRTi7|]R :CQFu[]bO3a1ξdy:ܽ{t.j2":Fx 3BҲ:c`a 7qxGGׯaEU[^!"(Ǫ1JТ@Nď!ۓN "AE `e32\ EM CX0/U@`0\7ȦfvbU2,Ä:^8S/}'~5@}Ƚ~b@ND( 11Oq:d2,kR@Fdj zDʳ-5P012B)sKCCaX,7/5>YIZn3ɼ{m3*NOL[bezc~k/(bD3F?IA){['Y='== Eg]Mȍc.Yxױ/\&NT:ri3D׼ _늒MUQVp%D4f3\;a$Etq7h~3"}q-$QHEP~Q\CJÓNk__͛ZwC>jJC4BZa #耾^JM5f_H @;o_'w:/f`xf۷wd/cj̠+jǰ"u̲Q09 UDlߕXq83OtQpB$F! 3.cL\+qV-GtMN\.Pˮ.l@>jK?; Rk)dQIzڧaZqf3zd)EՕsXCnzVf됡FY X?NOax,R,Ć"`8k, ;/b_;^qq.ğ[ia#M's^MaGmKZaIpi(IH-!<:8$[(l`ʙ:bO3, <L&RqђWy_–D咚PM gYD]C͚zq^/GӞ_D!cˤl騝 9؊2f_m},pF6 WRގF0=#ڂGЅ뢷 fֲyWr[︻*j72gXa Y-v<9.}=pfB PͿڕbU!n=_Wۨ0K+u@R($Tz :6x2BwkSU "b+ÚLBVT$f˕cr^)* {iy^ 4~qPZv:LPt-|wW\H WC?Z&ՋW__*?m܉` +ǩOy8b0Lg*8#̗{PA->pC[q ^Yu_^:Et-ܭ1chڮ"̸YUjV XF??pOr'en+jahڌe1窃o9__zӼp[R~=*4ەT>\V?)|"aYdۭ˯{e,WrݐIu𶞴:g~,inT'b@lb־F,zJ]|D~~{x3T5k˰06*,9p0n%όC$Iŗ6|hYԵK8]rXpa,[(9ۛsjt/o^kc0s^?K_@Y4:[0gϧWUPN @ w~W\xmgR/S6*!37MœZnO;^t70R,AIZˆTF>8ZH|T W=gˣ9!6;r?lP{=^"ꯋSpπ!-sAg*;08lQ{7B}Ic3|&.d@1ٻEee%-Z ]X bX~^NmrӇNreh fY$fB-"PbB=h'vF <5o6f;aFEeZLoglq)X:;J~Dا8yINZW!d><d02hUSsWvjH?_\e8Ugc,j=#^jH4}F`'{8}ޓ \&`k ^bRyp0^E5t/:VD'^!7Võvy\N7okUpjOڱ9~f=Q=\cd+kzNԾLv>wDbyIs#ͬh7g}W5mZnD/=]Ks8,ܬ=?>Pһ#vV]5.c ("Ҹjo㵛VTe EW L{TJF &edKgE/˶D[=oIڴ>܏"J T%$1G 01R^+-?W؋]Kd7]VK,:ٷs3 03; f'k $,a8mҢq\W̜rU;"jhB3;B[Zՙu6k(oWF`@$-h祱>qJ% DsK M`]k3)`X-,ZlDCt [Yv <==JhoB,Y*JƓ 6slF̳=:.;)m5HttR0ͧTv' C%7MiTTQT:8z6=:uAنn&Cևmat븴aRd7L UI(ЌEfq$ R!ae`UBk5, `npsdIm 1.bQDVvrM!dvq֚fTEA`"X1b:z )t-C뭃saN&˕CFvy%ʒ”0"6af{2g.hÙ*iFrE;"9h:Cňtd5ztNJ~bj^3 $flmQLXls-/!AkX {.ǵ`g7fBv2d{VE8jz3O[tf{K Cۈ\NΚ`VG)zIf٭z0(hѣp91JNH,ӋgG=DăX%@XF"(DQ* (8y~.tw_/:d!nt(㎼qx!A!#xI1- aUʰ0f M 7TM`\]DcG38ͧzY^^N_GD7`9рN(B IF WtBQW6P1DD+hi'(OhF"(DTAdAADFˮvr:! >WumZxmWX#3fLEDV"XDb bȊ*)uxyC={0c`o,ZN@ك`㝰ރҨkz&0HΠѭqTmG̩:r>WlsQlBΛPQ;$B>B,a[z^^DY:i pexPp0*H5 L}"{QI$8UyHX^xx^X,mPΦNg^#UӟĀt!uB> PD G !vBD)Q |vb}㻂 (;=7.Hmd[mtױpȸ#$LV6S6z13Q߷Rd:^y[5Ȫ.!1 s銺lfyy$s:%||]N"6@u A(I(X[O:7R7o U@&A(eut|B/>Zlx|Ϳg!D/,G=gIb63NOoYL+bZlwn{8˞]@ :^!/* =a}ʆsa(>1lN5z ܌2J ZefŢͿ߼C m0 !+_&x WS۞JkPqC·E'MÆ*3/H%^ʏ[jMIz mqQ4(_+\ 0CJ +e{p&mط,t\TVuCf 1Id(4L Gg${8e1A߳#AM%oq_m!i`_ >]RU{'Қn LBz:Y1Ϸ2 +FDDS7e?Mw}"ŻߕG/(N[Cġ+P=Jʭ4*K.dL?z#%s_R̘(b~5߁91 $NyJ>⨌ιH/ !7w\LQ -O;rR Co46Tb(R JCq?8 9@P>"ײ֮6VqlEGi }>Dz}oΜ,+HSw|ځ_䰧, x3/]7nC|q8yXʲ!AmOˀ٩# QVKrq0/ᕖMƞ;)>c0^qh4~Tn9PB7G_O8nQdqg>w3!  -Il! $`"""TQ#"ekdR@0@ PbA@HbB Tb2,X2@QKAAUEHH`1R@ BD ",#nA,)DEc ," *1X,"(H" F QD`AEUQEDF+PU@Q$"UXDXX"Yu;: c.i/" .oG A^VJ* BQ$*rB>y2,^G.|mdfP"y#70pkIKrx3da&Z*[vH'*c0{NIs1YmGӸӛ2lVA1Oq98|)_J}@Z~ C#X gΆ~+&sHff+]Tz!r_#| ՞ap8) M'X- C3{r!=5/[ĸٌ0:l@&NUgG\};5c1> 4?/!}f#?g?|n2~Ji &{Wiҥa{+l}mEƑO$zfH㈌`b7?MaUc o\ Dd B/x~nϫI_ڷ7;`H [Rv4=DYؖ"4T-+YC\<.f `hLWаptnJ3#͹fOgF(>q>B2͚O9yJ/woɉ1L'A)DI ϝ.;M/\`CYSژr8#\*mC5D 5mmL@PuRT)ٙ<0DA6cZi }_2%ޝ-?Ce:QtMUO+0'8̆}q)&.uB@-2\asg#]GCخoOk~s]nV\nh7s A%1nm4K'aSb ᡀQ $*҂d]y02Fޛ4-$NUE U]7@L_tx`7/lԞDX\$ߣj]_@'_"关5esacnaCzU}l RQۑ0Iz תBHH#iy- P)T}_b;sJEajM鹈&k!A[3͝RqY+oh" ]Y Q 5xgL _ | WWUň5C cŚW3Q@) ?><~Tާ oQ]nuDŽO#LncQaYeQ:RA@dM?tѷh D7QW}U~tP}X}bmPɯ`\:ђ}?xoJtp &b|A1[0{*zN/ƾ8e-붐% I]9ior j%5t  *8.mJ`BySxUٹ_gn~KO߾]^[#⣱%9e]-{ۭkxc/l+j^HdWAo7Kz~[ C&bOJ#yS | K(̳mٿӕADM =I]D"[K,]q~N#AN`3ɪl Tu@vp)\'s1q١?8=ۜ֏&ѦH:=>!qRٜ~G^FPXcDiF5O߼K1K2 - )jZfƋ5qndyb$I 4U)\b<" |ϐ9 Z N΅B}E[B1B%&rrxׅ'3nW/! ќV`|3fփnQ^O )*1R*3戀֕/6Ubo#};ʊ;,&.=J'θ  gbS/E RJ3l»9V)smbF+m?Y0l֠c_=*C{<ZEzRj*X∆A9m4gMu@qxy#%`)VTc ñ"<8jua*A"rP B~#7eAg  IU0\9)'gPKş>badjc<C@!hSN`:j_8dT͂zzۈ:oYz .n;]yR%͐C4+2,IyL%edTPVkPX jBۡ&`(2خPܡ,N , 0Pp:9!^yOOA6@ khSp+j4 |ݚ3VCϻ}Tsk~OiOg.[iwbЪ٠!л_vgfgؿ}(k1=ȲjǛ(,m#0hqwBU V|좁_3Zx~/E*HDz_7SsTDde7gKlz\ yo9; Fz^'8wgg(TWnyܭg33)r"(g ]kKgfgb[*Gʔ/лՇ0QT)(I} 3p@2y3Fꟑ C5ϕ_<ui[!qتлE`%}|KER{sp)\O s4)]3{ƿSDYcT$t i(ئ,umnX|һdvO<ߜZ{j4} uK@}{:^b8 ',Ī (g^?N?=1kIRwm|>:r1_Z">:z_ВN |D홭>cUF&ɪQbD1H+:-0w);oSWg'%p;]]vrPY0I>41ABUKh ђٝLm-ƣ.UR&-H4h c鳧q4mڇ 71tn_c9P:zgoGj1ʘ{)#gVPDѡ:,ΎAK dMީ U5XGHƥ0LjnԦDT4rIk:R?+ lcvOO~~!,1X|$`t\CbhՓVL(ʤ]4XQXKt@A!bQ#Or@Q (Zìf(ⅲ B˚'g10U{VõEsjZ⑷ uHHLd{*;_F .a[2!StZ 4D-6A=N[zt_;*;r`ZZ: 7i8V>WPtYYj]s6WTc)zogQx^Hs ?S}/,5wv-+6]m:V"4JeQEѺ,zň/Axv^1++Jzbc PPlx4Ipz5 5Z n y+*=|N| .(\d< 0^bD.ǁJI5<:9DOah৛o}߬}P ͎녟2Fժl @v(aYp,]L\o_:8\ǻ%k%yWL^^nKڵʻiy/kF?:6r-X\ߓaq *ǫ&~^C GWş1G{TO*bjH&CtrvG RĴo {Os[jP5#!E*=\78Pᄶih^s}"ZӦhf@ޱD EzVM-Uܥh̤i D-Ӹ-͌)x7-gƙ ki`_,WZ $RA`E(@z{;j(>VͼSpCt" ApgiuN拌v-罾NwڝT]3("E`vńqfhCmƨ})['ؕ*'U]kuIγ{'X-i}%C9RۥdGX!F97ضpMB": [ 03 j"E'\V21QhbӬsW")hBOr}^ u,1AzIP33ퟧ{wuri/rF-<#VO7@K!toF`e:>|jG|'X,Y-= Yh坕\T;yXC0*NpC2 FI%BC% ͊Jb $mFHfQ*a*B 1fT8Y6X"O+QH04Q (Xa{'B$q7em5*t[8nI;]V2Fljr| -N R(U*(͚ *RRtU@R2:UK* iN:zsz9l!͆cQ`ȡXA{lLX6.8ز+_lQ[Gc%Ӯ.'{N,(rhs;y)8Hŀ(,Xv9?S˽"iqi_:AK݆{\` @J*N0cV($Д$m].jl#q;HzX,R㼹xs>Kjavb vWt:p5.e xq/Ctpv5E( (F1Tbd $oxLytR)Py߁F^9t{`ѡ[a^% A{1$rAZѤC($Gq L[XGBN{%(3 }`,A HL y;\t`CL,`F`{m E? pLqb >ffo+{J;T\RSEI jpΝMedS}p(ʔB4wڷAKNUѾ6-% AHa2E]Vϒ',FZH2r,Wռ4Þ^|nˣuI T_h|,EGo{z;ܿ^DȢR{-EV>v؏ƹu`JBsw9JHV[) A0\{N=RsTPhj )K `L cTQT\zOYN"!IۂI, *|' ׉xaᱺp,DDPf:$$! E(T@db, \߭ˮCȤ''hԇM,k5juV,,4Cx&0RlFVb@K:pyCЗ(<.CXP EX,hkDuj-y ^n=H ܛ sVSr !CBVvdzFξtq((z{0I#ޥ` awx=szK rJ118 ,)( p8P;l,';  !eISu"OZ $4I0TCZ7w8NB`SGT6yE(EdND!͠ti/u6v!=sow pv̚=˾7Hnx jHg`&mS:(0:":B{ߦ"b R*EȌQEE ]T :Vg@$\tH,e$\#d2]-i=m3`Ϫ2 YSȆיwg8>>%2(2"\0R)1H,韒TQ 12v)'UTQkNʳHXѬ" DX( DE" !/?CbDQ$R DJ!I#BAFEDycTbŊ ůOħnkk{Z|﵊=QjȽh^lF5jqx5el 82:|g8F.Fl"խqҫmԨd+}1Q;5VHҾ..;/c;,uUZX>p«q@8HoUv1E⠗QLZa٣zu_#гٖ3$}'Cct3 S"1 Dٞ7:N'\@"Efj(xlwl(kuXK5&c4֡uH`)؟&h-XD̞ .*vnKu>yŵv[+ߐh,ozp$刈 eX):E1?x=©)Aߤ)IdiSz E#ֱ^gkIZQ=Zرb#7>j Xc) ضV,<+v[neMsbu==%sj2?epN Y9/~νSjm]2ϳ5sD.450@ 4ۀT-8+ kۯ.~iq/+f튵H4$d07 F&=0XRNyKӴqW_RQ=>LB qB%NBLթ1UM?},khX1>.aFa8?m4"hj ԭF m] ˕SImE꿛뮦ypZH%*ŭYDBdCE]12So,#EۆC0z;C%s2W%ápIޱ-w;a ŏzêlwTV %1ڡ1,wڞKK'ى17ڦ-EE2WڐEzd~2PmSZU& ~}20׏Ǔ/|MMz˘84===yUo%zпkh/ێ"z\#rװ |5w֠ o77_¢oFE5EԀspP EIWVɁ܍$``MUc2^;zvYazQXu_ y?N7绋٩sI[n_+֒+#{p w bbنLc`Fq1bȎdxH)OtPiym>e8R`Ζ/u4Wf 20<&l nCl] ͚ww_-̫5N:1i]qƥ9=}dwov>8xFi87S~⧤SH %pj䬋l + Rrpo_FB&A#ygt[~Xg3cἽ۱'Z}*}[ҬQOXPc d0f@0@Vrm"`K91@D);=V;MZblUEXM1 Q2pr nVcp-_ =}\ǜiq}^ Ҵ;Eq59gxOv`;Xޅ'٬J-^ڄwԇͳ2zp4fC+}+gR;;"%uQzjQ@C7zxw3rLN{SSqt2F}ߗ5bиҮq--_1" ME}K0]*ʵp9[` |TԨ?HfޤH& +Ӫj;~H kZ4B)?Ե|oT:BIVbfAL UݟGKX-3w&yaW۾wH{ZemJ$8jݹ1uۙfd`noyv9UcRX۳;s<-swj?odQgl<.Wϔ~GꯐY"i+~ =< zzDZϋՇT(" ,w>ߣ̈lg%)_VF6 X@G^~ c%熩gթ|%~ձ}}g(YYUQb" V+0P@+#01* 2$DEb (1, @dc`QF `TdA$bHc 1}Զ~^.k+kwpX/[wE\ݮrΠ^R+ZҪz`l_Y 2͋pC$f 3#g}ͧRʛK?vpkW:TC'w#TGq{GӧE9tg&ȵtHt #[^'(7I%%*,JQ?@o+! lDtX~KZ a, AaKޓC拍[;S|@2GD`MУZ<5TrD-K+Ii/@bJ.47V5 :@X9'd0XYa;8faE-Y/lM&"*,be+b zLU;R͚X2TaME$n*f¡-g|(΢W@!)z5I(ZZ!aۚrPT$VYPp{n0(aKRQ PHp&"ݤ700&80`1'Ttu6rkުϪ2|oK 3#ǸBs멹=$rvq=></:0Xϴd,r\ޜpķB_@{m""Ue/^[AUHoQ4@Jn/a{phŀӜ*nA &̄TT#I@ [h(T }W%B! V1"3ڨ2.EPZ(Bk+[RTĂ+|{R,W)Q]& s2^ئP$bB*=BE̓ R($Mo)=/(D/°0iG37af)BN!ti A9ȠgĬLT. e[+ 0,!g1e""l]"{2bkYY$ _XRY`Vh(Tɭu(Y(5l`((Jي$6uDe "f.i<6yD!p8lL[ځR - a!4 _8աfm@%gVY0_m .W * cQK$W0UA Ex>6rTزMBM;< Ej,GNѲ, 6 ;TR # ]2pBU%HJpي"H]VUJACPy GumAc} PQlbq aXnŊ-kSn: FAقf!Xf$fG>v]gqMr1?F7d,i<7e a}s9D+_XSɝ4#hHN8Do=m)q?i3eXwXŴy] 1[hQ4n7T61 8p  x2]6@  SDK8 iwz-@f!@Hųxn:uC~^waWK@U$J%ZfhbMK$qwzv[ F/xAO0?yXfYn$% %>hLEm}ѓd2M7p7rFs߼v!9b݌Y1R1U{}v|j -PPiVUQ\3~\~j~V\#D̗v\F2PՕ$p@k Jղ&3df696 cFi}&h;M+c60Ȣ2k-k*gsɡ F}R渚 P ] X@ 0lRr`)p,C ~!kԭEBfv7ߤѺo6VGmS8flv.a*nPQvtAu Y"9 j5Iյ~88&||־l35Pf u^[8` ڱ s.`OI X 2 /u .*BVH)(R`wuW;hBXeDS@c6u8EB%*ஈ 3AkYT@VtUN TnzJAҘbC[Nם}JHsxpC6̛MZճqMYH@jU$RXiѐEl4;"n( ;T0 UC0h)m`c`q Nf7W4 b6\ȧ`{mfebvl=K(QR@'Ib@+L H*FuW'K^6Q ACp\xc#YH3fmT%qsH@ƨ*Co+BTnzts$٧zMzT`^V̋Elvb\=ٍw)G:bwt^;CSݬ2}|r4  #wh32"U]9LVԂVT+@&D]Pz ~[?,_W3 Tx}Ux EUC_ءEb$d3 Nͥ8يj6ܸmx}s @v%UMZ-H`I01,6[7Z?xVf?^$hE%U]iyT Bvļ?NWdHn2#2 wќZv^&.c]ԭ+n MM 5 '/8E6|2?vVd1\yn_MX{.{, R? iD-kǴ@0 c~`"7?,=?-2LȈ c攅˜yJ%%Q+!@ؽ[xjNZfNmPRРLӞ#=ui/oMo@mT:)؜,4b V @+U@,vyTR8u^[WVZюH_/jeM(v1,H!0@4*XlG~2s[]uksKFvp4sMw;Dk;=urcgԯ|^}0xV7WV`֑0d+FD?nA9HT:w*ݫ?L?۪!a.EI!a + luZG,||7?JܶU?KZn?FǹZw;ip߿ a>g7`n%nכ񠌡G``ⶹvbfBE[QA` TFs, iwv5gͿcq\/3^Z7z<9!vT*~225H=%G<.U55$Iѿ}<ܜf 7nyn[+zꡰ7K[@Le1;gϬ9foފojf/\R?,:~Z}%2GB NךΧ<L.yK1g1w8M埼MVѫ4r] ·1Jֱ[GӰ}4MY[h)m@2Fr8 $Sαq%y6qڎ:sqՠ9x׊.~z2Yd=5ܗA*?cAsO)r!bKMJVP&) e,-QuvڠY8^eHdf"]} .(S:8T[lj$$lT =H s ) qnƐA$ъ`}E+ZjC`_=#(^榡ٞr5y=[7t>z7h>g{5yۦ崕ƺkg:O(u[FKxaVGhrrj{*cvQeZ;_ #=^ǏBX|fgK11NTgqI}Vz̹oX!0"%ƀВ۟jrMlه#4Y~Klڵ{mcry+=.2nw.w_ !p0ppFl=i;tj2`+ XIDʬC5Xs]^o顛YџU oc"lIUa$Y5#[317&M ezprv ٺ՚bߩ.;!k:vUsL/:#u#[Yr<@ WFc3]RM4,=4mˀr(ں f$/ W fjXdZ|׫҅\6<خ <IsL%=2ȥgFcUn[=)85ˊ ;¾W=݋eTZ~,%|;-<lf:V5w#kVIO>KJ ġ -Dɂ3@f D͑?W9"=N:""(dUJ|RMmT郸Sdp,1eh͌nQ-[}xbQDlLZvc w͙͔ ס!rԄXegHzeW%C8@f,k2c6 XzMݠ>FuH3ѽ7L_ 'ޠxfӜJ҃lZߌ/Tld208j ̭+n*8tWZ:] PV혭o"s,f{KAu[ނbۢRZ&8b';}3IZJhA2#x4{[ ,N ٫-Y.q| uty3yESx|}Uz/Vۂ5RuPὬV0Ak7em-h{Oӛm#5A boGs,E iT35^=ũ](Q:VpJ`,iIp\;Go, {U>6}k>ߜ-z~Cr˱8&}O6dݧq{\v"*︶ˡm3oNWmU/6+S" >L[o_"}[aȊi'l= ^XGm7#:nM;| Y F}Koݵ|DV+ӍWX)?`#jߎ:U1N~fhҫ6Zke[LU֞[axjv:{5d"[>G'q`b7Tj=,^c+C[QTʼnLwWk]b1+@yT?>ߏq-˖ouK8ş =%v/F]K}Ca,=2`,rrrf8zqd4éꗠEcaL/䵢/-4Ζ}Y0ޣ=:|M!ꉹ .j4i[YJfx0./ __q]? &QXs ,>[r8ήkCKr*( "+HQACwg(đ(! 6훠6]<~)!Ϣ70E%4`a0~;Dl 1q 0J3rZV}CIBs@ &@$akC$( НThqS`Y55$ @' _m/ =93CRJU`Y%i2p#3l i$BR*>tp YRzɮ rZ4Ҫ+֛OݩÉhU8?c]nMzG8y_FQ;(D1`'`3vdC o?yd#$`*/uNJ-do'ڢgޯڣF́q]_§vu1 l xV_aȻ=z|P!Y$;Jvғj՘TmLI#VƟo2%ébdFf`3VΨDFk*7!RSp]mܛ]'B%=Jx_F$SȨ&R`itM@uW]',$dXX&/=CLrC ޴% b:rrQ7dj2(kh(DmH&z,ҬƑYcpBF++t"SP@ɺ[_zIY^z3YH%վhD4)NfA΅'C>{}Pē$,ײQ>mnqk3 $KԞR7/T/UrXpҢHp;%YiUu(xN=yʫ-U]`R@(c+QK ~kY8MYbJL9@J'3󆎃Ti%kR=]b$LHCUiYz"jmkђn_K`ݕw䐇rxϨX4jkf&]=b[Eʷ 0bk_AXCH{MW@(HrK5XvZNX/gE3xz+%v$;p=X$,lrq]N;bBN%BY"*H޸0h׈upA ե%${.r5D>De(X͞4]RUA:h+H+\WmxEPQ iJ{(}̎C>p`Tq<`r!K*Z9S&8yb4񅶰("fT&oICtU3Pvֆ Tqf&Sn GLgK,xs]Q)$ l+!My$æ A@2=E|gh`,RDIJ;LQRZqPeb;&b^cIq@JC a"*E.@bA >\ȣQe0$hO[HzO*ʻ KUUnGϵa賚_ ݑ*73hjw׷;%hw_Zw^#"B_~_AZ*[ZKԘ ݬNجS1Ѩ /Zg떌 Z5, 5~Pf>+Ѽ'χecՄ0Oht T(<GS*:u4<>d|SgƆzdd1sβ` IOlL%xA<4' eزcƒؖq6Y#24R,k"%"bͪvacTdX -5qgol3{SIXq#*V.mVD y!! 7SYL2d<;>+=m\( 8z*'{o=߲*Q'ȃDKGç'aWhZ/ʄ x o^o\⩶#h&D- }H4N[cq L4M3m:K$A0fWCTޑl%x>E/n9DM1:SAI#Ҫ!bT)A,cȶ(E Jj}q偼FZe!`wh2;Ҋ 7qTJIנP6~c),j BS#ڕy$Kz`݃k}hw~p P`+K Gbcq_J4dKX*l6`2@ @H*j8%isC$ N2Z;0kfludȦ͗j^51jfꦨM`}'1 36} *ޣ}U&s=e 3xÊs7eKc19l[!=g5b\UEcܳ#_,W )z?7dLR,_˲ܶe`)`4O@PA 9S.WCqQ@˱T:CBQz"'Jl2*c] j*d [&jXy4lO5,֭j"Z;ݞfEӶ52";OSPgS^뺹Zed[jSsU[ߺUp޿U;$S4_ ǠTazt|-Q bL >`M"mJw,%ˏ.";r?Lin/~S]St^btj'pc_{''vN׳c%Mc+$q;;ig9%6)-%LCn}?+N2d>_cmX*NKEJaQGuIERB#Q8Ԓ(rI(l͵>[3.oe7=ɫMeRr2. 77dE%~f-iC[s{aӜ=k)`z˭:n|Mnb-;';C0nqʧ ~wJuu8zt;iw0C@Ep<>2&[&+fmbb̥TsW!s[m A4(-oXT'T0dbRy%\XkBJrI0(V V$w$A,0E2)dV'7-}[|˪35R{ FzF3YuZ#VarLo Um~~Ӷ])*|M$:Ip[vM#KI0vve)GO@K{m*B%@ ww٥U<;'qwۚO-kY\}onZ_q]|ި:>|_W7{}Z̕ +F>)}if49{==hч7=G{]Dvo'ϹkϻϏN+bݺS`z:ׯݾ]e>|9ue{Ҿ7,sn^װrJy>[f,ۑouݾ[7|Cqgվ+ox|[}=vj@}\mwoz7;U}}HCn]r֞6PۮGdzOKX,N\[|ٟ ozܠ=o >=om@4@h *4i ss`=r((4P(W@ PUJ*HQ.!_oWD:q:i wYpqׯ<-w{7nG}3>of{o8vfh3w6q֠ 0M@A Q_m;iw}fs+]ys<;m{-o\ܗ{E#ϖpj|o}+wwDvO}AֵϏw= SFx4}MzzzǻO@E(nl2LdUxm||tmԝ}:@hƀ{̪*EBz;7fF株RCý `ۛ7uUnӻ%J gu[V֚ꪕT P*x@)s>9|^zogm}\*'n9z:Nێ&ڎyI@=aBၫkMmmӹ 盽g^vmVm7q]܊.y]]ؕCTuQA݌MH6`#ϞSdNjصd65uv烯 ]l{ه^Q@ke;(I*(ER*nd/W}ޞs.>w} $P@9xr;{n=}`$on=빝gn}LwӯJ۰Zt،tDֱJP @@b`d0M@D`4@dM&G4ѥ?* 4 &L2 S&hza1'y3S?HMO4MMOOSS'M'mhBB MBdțFdJD%6i=MЄ2i4b4(=FH44@  $D0A 16Ib2y26&D#CLi=h2hSLAhBF4Mz&(1Q?%3?RQQdMO5OO(jiizC 4@d 5"1dbi&LLL&&ML6e<~MJz<pLRTF'-R?o(/s(#kzaQbDF1c,%PXI%?f! E)d?Nq9 Y8{2|37(桗C sJ56Ul ±f灃QdlO2" &F5} r~%kX \y ЍZJ4,$-̺[U 43XZQPQTV$y,^.FJSg&tRp^S;et(E Flwx]w))$PY+aKsE Tϗˡ9r:8"ZrF -VTguXsvw؈?7 ny f@ 5qM93"z)MdH)EF J*XT2EL1s.F ҩVU,a6 sރAEq+7TCU,m!piW?8sw{FլE_4hx͈ڈElmXm*"Tw`QQUTPTbF h[l+ETQQu!̚E ?#Wl@r C;Y+4B.8a5tN2J6P2p M P!() :Z?@yC-QޥdӡenKgC52wV:HK. WWҤKT.r.ij\.fؒuvh#K[ij ^0;d[K虫Z]42Q&M&؛hbrkjm-+1ĭm3'Aji1&eO'M½tXy}5TbSwEkvu>;'wHJEϐ'Ei:]{fig{lfJ9Gt'5q,M j `K,їOT<lJߌ2k}xW lY55V1J?e;ϝ;Y^2+M@pë2eFY 7qL+&o,KcN,vR巌QH6Rk+b1Pe1"V궮e!vS7r`Fyn݌f]ٸM437{r[b Iڢeg:fe$mġmƥHl3Y%^d.q4֮r95ޚuhbLb$BFAӝrVQyZl"m-,̕M׬;:nUvrY6HFu;rNj4%PY:^Yh6Q.I]LJ~<lx-6D&䮐{ &%ƕzք)Qd˽tɗetlk깡i#{?:(8/]JA/BߎoFi$Ơ.>+ӵAby;.aQ(RFeBUZ3פ~īDB jB ]bNPBYIc8f nEN*0y+Oqf .dKPU!@o4-PEE ~HN:ֿD#6:x7^^n i +x;F*'.v4E!ZŨխB>s-1yWi˩pkQmBw6Ͱ嶹8!$fO~C)a`%ÖC/mϧgγ>&#X[ԒZZ_bsL.PFTuDziIC3L5k?$ގtM^c7zebOY >G7c8" (e`JBB,F1`Խmo$&FdY9՚6Ns]`HԸ03.qw+&ȱj1@oz67 f7R,4t&ne64kFjQ3SYˢ}4t ܲBea(E!y3fN&a0jK]k}N16Ԩ&P"h|xeƗ,-,4 DUJK/94l3EzaJf3,m98PO[*2VyMbLIo{?K'R#bv5ѐA4>+T=@0"\AD^}w=,M*oAHZfRo311cEFrC%zYR6õk[FŔz`9KTs'g? Ctا()6$C Aӂ>h/oO'XC!F O_$AQ"W'320yRU~c:0r^ϛ ^QgOI9Ei܈:q;jQXT RR[wnwiۿh@kDQ &8bTT$B)$~Q{~mYt`s`9r #=3~|e}n_5kD! g5+Q/Т B k0{gsJ*@IBP($2LwAPӯ@ ,)Iӏ,n{D I$HE$悥t*ۆDTt"K}[.@%*03$ %| _G)'ll_ؠgj&SYbddDjӕW,٬  /j h%+^}'a<#(xIF]?x9Rd~3rrٽx  /]:"&hi>̀jA*6ƞ>g&G W?@UO T9fu~^8}zw4' -dY`YQjP*OON4/<_]ࢅK'̅Lyv?5Z8s]0w5EU"A$*)*m%(o;` A̺[¸펞T ˑ)\L7Iݑh]pI+^/ҵ#1ևfb[^`Gg>Ы_K~풭:O3꿦)T836n2}`[@P {Ҟ5@ ĀnG]`y'DrB+JUJ7ܸTQQAUAb)uknڟSUmkJP*Db" L?FݮG_?fಏ<)v߾R0\PpX03C>eAHs?8wX "}1P5ڊ"q ^S2AE,ʾ>\In3i_\C' [%Ͻ,rv\yE`g17 !c|3[dbc5..06FCPTY$QCb@|?.TQOKOwG0-0;8ZkuQ$ݘ,\U JF#6' y &\gSh#Q=?O9nPDI Qz.*Х7lA>x0gFQ @$j2>{m\8g;@hZJX{RJB~=swPFj>k߽0-v,`ȼxyklW6 (}b^o^$00jAa\ p*: +T\ jFMC::gMwzz0b|x>6E ɎL> >.oW~$lᲡZGOpu] BTeD=3S55_ki֊ǔP(B ̕m?: O_E*u5&:FOO*=;VWzĪ'3*T)ZEB^Ő`s45e> uT0~hk }vzMqF[* hEXѶڴ,~7~/snVٖ2쌱S)ȁ+]PUK+)fkp~?A@ 34HUy0R#(YNd" 1UGJ/{Oo'XyA3h[[\<EQ4BWaZ*)/\Xհjy' *˴Ndzq9u{ !qs uC yt:v[=aKQI10Xa m}z'T9?MZoBE`i1TȢ4 F7+QJ)0-S0.p^cz[j.$S /1.JLx)ZT528] VG |1UZw U,u]ڻEDD@KNz8/4ٰ(ݎƪUf.ww#~޷ݥQb11~\3߷tw}4n| YiO :r"1Dr-FT2U#,1L#T7GCEY˔uPA")>UF+-NqU-RMEJD@BёV(#1n[+DTeU-8dM"IiK!TTV ZV)8B'-ljڵ%k`)UjZ kYA^ot`ǥzwnz&¤JDF *4 $DQ0QATS`PQT{ǓoGE12DPE!TZw3+TO4og'.O,Մ.\3e)'rSu#:_Ǻr}#NftPUiDZ*. }~3;x:)aATS{k{; DPy'[hѧަ R"E2.k'U@oc?1W0mBh(P2 Lb5S#!Ɂ*(fo;vueeQRQA'3)p^KCk6PzwB(5 DSIL]XI78qOYp)JJX BhH'b3b~ZfXUPqwz=хI$idPUɓxky$v~ǯM+(ANQ∫wR$KJ㔭[S3y3ILjVhVJYT^WWS:j:4>|!A< 0дM@K!AJfT)Sy(,T'n@;O: wu`޵_Ah%R޶9fa:i?xO,"G98;O!!l&X bv|ٯL_|{&p_C{͛2e;TuۭjΚG6Vx/sӟUAF I*V(E Y},txOfyN6<趨zYE6n[Qf7n̛aiծ.8XղTUp_mXLݷ Nk"vwv7o dmȒ GC#0xrARP*lZCŽ>^R8Т ^xT&J7 o7LCpbA7O 0HׂH4sCK4ɹگ@jC=2@Qj}}z#AK8ѴAMQEQIR5S㽯Pڇr=Է{kn J R#HġH%#)H)T CAl9kGԄ&Υ_7)QA**)3S:Ϝ~/~+=Ӻ О_СգM/LVww""MCvh!!*BĒSIMQ,1TSDU#& 7~mqdAP(_j~N|Uں?FR1cR#OdHbziQq7'6JI0Q:Ke-֘Cݢ\YNMփe=Wy;oC ;L /FvXώz(kC\rljLtxz;3ԑaHZ`Dڮzǩ5*pkxѹɑ'q|:^~>kL2e)"5 '؈ `"r1 ײEI+4+(0DQDVamZ8+#m6 {-b0 ";c{w婲}O_xXӞ;%ED6N̝A5M ĥU#mE1 qE RQZJRB2-5Okdw6*bjve7w c+4WXj+M~6od!HR&R *GKs$.cDT cJ5 ڧi򇂓Uђ >ݘhXNXiJQJA'/9$/ 0-mڬexdR ?>P"JiuYO%rgpA^_)` )x/~ԕJ/?woOJWOa@ǫBQ9}W9,6!#gFx|ڄ**j "iJP"ic12e`JlB,Y#l[dq(2ȸ(NebRP J9PH@)\'QɤHCuM)6;g%X$m<):|dbT?Q^+!lzVu.` V2zj- ւfxVc8jO~o|K;ԇ]=:OH;C3o>LPUI>KdcVHu.7s`֖TbrKU>{PuYٚF%oCDU+3(ٙ aP?qEc{"$ ̄!fjrF&uNzgw鼯Ys] -ژC;y5LjF| q;! ^&lV;ۻam!ɠcSEHh@D.}# nPA/mO`%r|( *)+86OݝЕM"Rѐg ϱ|W'fzVnr;bTb AGƶ8 0AU`la׌[5ڛuF^i I*TLԹB˝` 'Ekd I^ƃu17s(A'[,.<+8f>wp%AS8>ck@{qP3UULnM2 @N\Vq=,*jN"rIR׳F$`7. W_5_N*u/f~Cq0ldCF5ln`dhd9)^B2ر}.JpYX?TFg\/5m'kNQ x+ I& R4z\vRRUO +羣Qf*Q41dTb2{MN26vhn\0.՗#[#) T ԉLQ >W#oK;Jԭ)]EEd C0й 1 Yd1KCB.8cc̘(-Iئ" b b)e CIIIBF4%#ZR[_iQQT #lBɣ Y`ynBHTjia|Nb0eSG#IPf>V6kmGi@} $V%J)%(z05# T-UqI!BTo-0%*"GsVn.uDO[gg_4QP8?Ӵ pIC$>JIv~;4dG%*,}b47债Sߘh?nEoX"$C'z; ` }"e R|Fxxۄ; (ge''itؽy)hC[ڴ, ǥvas|G4o(BNћ&SCU:&l2G5Y?blcSX/{?J@S?0?=WpY,Yކf Ǯǟ J;ዑHHtwCM"P4M;A)C_{IHQJJRM$UB@U HT4PD BUR4ߔa9(r7pHIEE(RSQД% TML7i ZB hS )Dn0C)hJ  i6JH))6&yx[ 4 (P)HP@%WV d14!JR]y\5DLTF }3屸=NHϠI\gm=N'TN2 ;0e8j.XP%?@?KTcJXtGFaMBÉP+r,u{?q_Wxa_5JQG!Np` վ˭D'|Ra}Ryl_saVكRm@Q|7:*5Km7(vovƃ!Ӗl4PPAթ0D(V"YNP)0@, (0pm~3ܶU` Jʬ+\bȧK3"ռ !b:ek›=4okJ%z-MYk]1:]ϕ__0^A:>GԟOm v5@K j |icco%Wo[vwU_?KYZc=n}.)Œl o|-2o#j^b-̰ZZSG>Gǎ]+j}X8K(UZw bOHXt-'٨@`"=~{d,ld-5\,V]ӁkĴ3sZrCyxyu_mxOg:5p賦9g}r}W3#) ((:Tj0ϲl(>R#"6+U'?/n;]s.*# ]dK!>W(rg %邊OIg-=rƭ}>`T=ߒ!ؓ"֯ϣ|-%MkEw6'ȶ |`Ɇﰛ |~}G$Lu *>%䟓+~ fgUMt:@.왢'\9o~QѩGZ*]БM+6UD/P!НWj Jf|*S;vOKfw))YQ W0"(b›|l\2QULE~(XO_s9 ud> !|:;r(]6!S<8t:*";Ky=+qX**1TD~ /PJ~ze, t\ … bg<6~93t2?/ #?* }KT|!w?0`k[nQlT[ԫ `bq(v[6c1<q o AP]#]~mNi;;VCn ’WUӮ "*m| z%3QڶŊx;zvj;5`y^)^ͬT|ZӺ @JRQA","?)|v~2ѻ==!C6cPt|\RgstH ̸g!c˗GK԰F;}4A;;8ѭ vbq) [q.6?x\g$^{#^a'Ib {y䂉Q+D&S 0F vd~t2Y/;.u(8޲ @CARPA,/ik Xu$pLRߙmD={b[^J0zQm1*hTd1#hT)}3BHLPiZbQ ^wG?<3y>֦GnKMKk.{hyPrQ) jx: '( XD26Q7dQ RY5"3$ȊI =1J,r F<Ʀ.Spynv7ۯhEoO*kOI!dP @r>h`;5h^)GXnHlupinoϜGNNCZgDO?ޤ6+ޒhtA$t{:p"؀(E@ԫX&J۪ $RMYc`Ǩq8E.7R zw7)\vPaY1 '1Y2D? `\B[VKUD5ZJ]`l/eKN}J΁l|IZO%udEX<s_TfPVP܃_M74)xėK#h?/ u'M\Y^q&? YP:j fC^8+oD8D2 ZAb}~ν&fYYzd;_Z+su)k,rK0Z2T=Z{P$87 Ɍ22DA1(TD`GF0| L0z`9wYhM1F(" rT Qe4 \nOجskFwٙs1=_oqdMdi0+o[^KLHO0ETK-錜T0SHouPjj-I!J({(Њ+.%-ùp朙`]%v " ި\{TJ()1Gnɛ4^cUzs c8HR4!bZ G$-lmkUZJK)w5\uۼG䐌~Tr~[t˃%F]بS-eD,*8C[o%+Ur&j `:vd.'ӣy Z_dV Ui;v@CG]^|-%yS&,D`UXXoël쟢=ݓ_+R|$anssG2˩kT1͐}Svx8na0G߼]8I5a1r$;cA2 BM E%yXuuDJ E>\|ΚZhha W@OÀE >#iļ$)EiTzl>d@{l|Fh4Kt iNhU"j6b,du'n! xeǫUKp\/<੐ʭņ0ShQ*p4%8jEI m&BPC0R[E9*Фm7.v'r+* P-#IK{O?C5.#>au;Ӊ/nuAUNKc ٍ=dYi  ևoK3;( G>X cH9\}~Cvxpyd 7;蹖&k:QnƱgsBza8zui)W C@Y)q:}=` 2ÿ_ɴ!˜(QU3@1D)RMUqV8J 妸;l%QdT||=^>rou{ <fюߗ7:O|iQUQrTS9E6/3i|uVJe6DBUe@HAAEDI, SLTE!LO:(| _}7> =X~"PB;YȝJއGݕŻ'rH~RIP?keyGI/#+{g0%Q? $"QPnwb \Ȑ|) #3#I;*KB>7)+&fG((qK2I>, &Qb/<,pixe,NX]S- \Z{%|mQCXSs" J^=TCLk#+k3W! @g$hJh(O 0q>$m {l6ENpp>fF!K  (R} +F>pX41u ^Fu?+ AL DIaGnĆ =qVۙ[G=_E%|e`U/)u`!Ł:3c"nw2, rB`8ŷM c[CNR3$sA"RrSu3nH9zD0&Xm rkW`%UՕs"S$)"bRZ)i@^iD@픠?wFADՇPjvYoAh"ãJHR4 "EEm`3ZkYtRpaL{͢M,"CU|>&S{H9 qeiPv*RPDAɥ ij`(XZ̚Q*D$ud7.MX|B|Vf )Lh B 1@PꥋSRQ>k}淞癈eTȮ( E/%b @J#HJR!JJRPnH\{}:ӳJLyTITO>t@Aiǁȟ">QT$@y Z e4b H=3wәެ/@Ld7?qYO:`-smc'j7!o@xw|+ Lc+%ÎO}+cws!_6CM+wn>ݜ+hь@Qk<ǚZZ>g} WFPp+,(PRER=]lAYonU;!U)d~O ݓ[ꊎPтR>RĔ,D5539 nKlRV`!c^437jP8H!DŽ9m*5xŖ0)U0tgh$ XqebjEѷ\ߗL#.WTѸ|i9=f?juX)F7R|*r}ܴvg}[K Ƭ7DŽf4QlЁ("F$E"} <"j/d+@ Jl.RP;[dǃ ?{=At(1m &=>tXo] ʏN V0[rm:i OЊkR#AUFyӝsv$VQwxtPrDlĕe &VNӷ0J~ًi,̵ T!TjQpp-ZFHBT~bBśO#wwD<$QL;$Op <=7NR{UlU%{Ǣ1J (VXf6$$Ķ\TBr @f|Oh>tb|&3h7( XmaSq]}r2h@D4tlq2T}@-zLě Oi~#o繰dgtg&}F[y7"SQvkdXyԯ@?qo3-}Bp*'3[ 4ر|_D8u>B2\vͼ ~m7S5Fj8+Xwuw\F3>CZ޼IBiWjV`HuVIV E:tP]T5RVV9D=>z0o_ж6`/j3ƊBu"4Jr]ݼ Ox{ϻyӢLmԛZ #[k@*. 7';<8+[1,YX,NRF &hN D0(Sye Nm\K0PK}Z7{ )(c̵HCA u8|(#1i󤩑HFTZNRxjN?LHm@kB0v !rˆ*BAB L/]u"#GR0]eAӧ^=4y$Gg/.BAX!"ib( hp|'|_gzYO7b-.Im! v5BacO~S?qXB(zW^YE(#ξ E`1Fi÷Xp @0+1яǖy?͹ԕ=<鬞z:@0 OR 鮑7ğ8tcÁc|M|Yc1 pݭ )1D}XbOL:|UDɓf z/n7Zu8R; Sf+R9sKzs'@^'ހvYx*_$ >B* (M a2QŪLHie&|RM!IRIŬ !C"`U5f++8aɘ# 6Fua*a-5aTX3hd#`x~84@w#8)Ǧ 3/`fe%a ϦPh'FtUC=ܰ>&^/ś7?3b0( (U((i 6u[u_tu:+βڵXYGQJeBn[޻O'1PyK(%"9abCq ]IJ~`#."UCʈ??OJlه=_G `ŊT82Vk~AK'K#UL''8MM7*E^c^g9it)H/iHF߅4ǁxK | q*}[o2HaRC:O +\Ɂ4#d]3 Ʊ@^7k}UTXϡVZx!Qەi} `㘷 bmwnhRVf2|yP/)z>nZ;)=)dqll.&!PHeJ`Qr0.Wyqǐ0 7H!\cKCW7^H@6 > e3lLtzexwb&[%z>iI'Ei­mv1NcɠE$3ozs/q?|xhSWv4+Iu5B}q%eX1GlW\A5_JZƫc]p;`;T)d#dsvuOQ=9peBAAeRD I(q`:!YEnlUu8+W<rfW82NjR"2*H{&ؕ4ϛYt B8%Z_߄  ]]|(GQ JETQ4KC׵gVģ/K^u糏^؃ֺd$Yi}nmZo3p}$$)4g1ZpI{!DuV\@X,]|eBkl~|f;e4}o~`~8lV|3c6Ek57@VM `GeD^[h8#jG=Ǟyz"*+TnsVP53Wnd))"ecQf S1B9$=>(UE&/ͣkoʣƞh\f zUm0xhUN6oYUC*>ӄ=͓9W)l]Ȅ6P{(ff2CU*X)GRמrX{1Y Tl;ߗh8` %TÏN/tMDw_(fif꿼~YE#=hY/D+%aU!h+3;5Ԣ|͜XvNso~oa[@e_g,Ŗ|Ӡ$?6p~%M=wk1Bʭx{5RћrH_1s #%XM+G2GDhA,AZ,"EEh ~ 5}̿s K:>l|x7QE?G 3Vۣ6S׈|#Ln.D%(PZqDL==FN=w4V,#ց,:+[tx@i~pQ!'TZI` 'Wbܠ>/WW4;*!~ ةdX(ȣ̟0FO}Qgؼ,?a{2sfx@k>V ,CEvEV*|Iuua,M>7pR-sV&ަMr@]]}}¼8c6#c}_ 9U&Q QOLH-H}Q|&w QM CxA->lAovsll@hZd0=*b:9w2EsPCifJRE2r 4&Tb2"@j3(W'!) $L @Pu(е444+gtx[wǜlV~@>?34QO'jQKpOȝɦ]rm*x 7N?G!giVkwhV}Xhܮyѳ-i 8qhb$H}@j)HjЧHFޱ PRW v&=YJ$jϗ\DRH9D(?1BRdi MH*7;\ W=Nk_/S*8Ft,h j&4(BZ9u᾵K38 mb|&ˊTXJ{sw./Vi2^*P ߬\ z*L ѡ#@]F4U˭&e);"gTM%Oʳ|, B~y5>ZY6!#shLE-@y 6C|D3LX7`{ K֝b en>պ= \ }xR'H#eu&[KKy:d{kՉ鐓kvSqKd5,_kP4T,jUWU Uo @)HLQqcQLIE H,ƒ5ƃg :Xqݓ-W/PD+_z?h*D>ܱcн<9 <G]' !Ff= -6{볖X:4Yor HA#v\Sp㒴;|'=>4'__Q99" G|l _Ț6mLlg5q˓u6,>M/ f&_}?,1YU8,@Z/211sLN}~ R(Q"J;rw\ nz7Pp!Hw,~9Q m^7;W<5!/ z*B0oQ0CZ64dr`!.]!/?kkG}? 'ڿxH{<;bk Ag0h[<Ù?TE$r- D5}c + oSj7?Ņ˂7\l 4!QhZUE3*,il-K+bPYUD(ʔe[E*%QekPbA6PQTj5*XEKFBBMaVB"Q%Ecwj ""ESR̅UE U3TTMM QKH10г P-HEEIT!@M)$AM4 RTt-҃P2z !'qJ҈;oD`һ9^~k-c>8 ( ~#* =nXDC$t3` (!}Vpt3o1GǁkVya2N'8yQa(gCEv_A}d^'9Փ]o(mHIo#c]h:' 8䣍%F4 !)%! Bv=rJs=62̈́Ez̿ӊFx!AW^XHFXvU>wժMYgՈ_ob”rb̹#IJQ?) .OQiHoKD-0F8@ c[%<϶n- ;ߌ?/ 37CI.?=ڷ[\s06 ?rӼե-9>cmqe]QΈZUt䃏WdvRzx\]e¿#t~̱b\ @H ԁ^X AT"g>=8W7 lxܸ^3.n\$JzIeWh)F )⑂ksu` UWŌx:p!8I{լ2mZĹ>d6A9Wͱ"ѐcH`k2;7"O X䔌f;<Ɲ H*]pawP%7ׂV]6s?[ ⴴH8d ֢R]lQ_O;}6!lt x?r m,Y+@TBTj׿w{_x %0Mʚlz<1x#- -}^1`pB*!Izeu(y݌<(漞)ژt^0 ﰞd4h ^Tz0X@ڸ?Q1Y/ERwj!ٍ0̘+*Ĭd Aītp{z𵑺v/eDTwjJ,n FNj/| q|S4Ho 7,WOG N=D,+'maW@<5b1j*MY̥㚆~o}.Ʃ/pJp#|J{M?<_ n1!rtA[jeZ;~Ϥ,x}|+dM=" {43XVB۠U;ZS8{;6(TIk/,Sߓ<?7qtױ: >3LMr Ad/BN,nRE+Tbȴv SGNyh˛l>ivbp`騶 |B{>Sx rbH'H_xow/B-XXEV47 +K@>TH1 RTBҭ)K1JHD 44!JC %+Ųjxϫ\Rc_cɛ=#{\},`UR6)s g'PBkEz~bkoKkyd%4KHRG?E%&A~1ZE" _F7 )bR)['\σp(1N7y;,e3KЮb."|z'"QTQ>+TB)"* 6(*`$2 h|sJ/`\`g8{z|9Smy) d f|{VB8\FXDi,QUBIcu:K+?yE|VJkF #uǷg "=Pj0VY{v;PKV*"ppqV7y@<)#0CހTI#u?[bJъ`(xBEm,}"?fW5߇YGYW"y{m ƲLbhQ:O a anÏ؈Ph$0ߊIR5CF ÆI1JOD)8$!rxs4̽^9='j:Ӊ^ڲX,ZUY׬FXKu\ıu B~ijEݜ~ XX!yHQ˙Uv/pi (ZetM5W3f4 ǗEH4M+y9iX dl3f ,x)a#sT-~X9]׶!.VqA6i5Õx.mm |$̼u 2}{r<@$Ggv;5Ε(i){S!rZU-bM(U" ThEKFKjQ2$!Օ(4y ը]Mu  _?:K{׈^ %@8 zf> X^x~FdOV0@wփ1GӎSPѕH:[H pp$)xmRҜYr ȈfqhK|^$ ֵG O1|cFBHSB ?PzXKo뤳 EVa*U{~ϑrJ--%3~VRJ 檖(Wd+UCJ ',X*TnAApm= -wVzx"k ߚϻ,:_yXCQA_NdG+Xdz[Sx!!`+6!XҽjL=*qWfiy]B\E\57sXL`Aڬ;TTxxy<ǁ`k6lt yUNWfO (frWTQ [8ọE֒ƨci~jhJUnĀϕ_0;Ùd~$Q$ iO=S`^wډ4t+J /r+?\!3,02Iě>q QM+UגbSS' G7}w}fĄe cQuYLX~=o9ϤWp"VU=g3xvB//7-jJ%VW#( 9#?B)cZyɟjuwv`0´W/wkWd,_7 )m&{Z%:XSȒRI2Q}h\*ݯ BCpP\Bd~kuM,=sJ XD(yz v?K'A`,!( D\ Tς60HxoXB\2̻AA>3sFXk|Ρ >1V/| ߻>^o}6 B֣">7>gZy)\*j|Jt&5" ؖwYOQ~/R6 2flƀ(a 4 x)[L~SB'"|85_E,!#8ZC#~ SGVe+H(X\a@9Ç\?~AbFN [(xGLON0LYS/e!-1kkqa^~>h1U<":>P+Ƴ-/@~cóEEYcPm-Q-mUb#-R'oI6_2N3< ÙO/̓s|qأW{үkqeh_y״7vr>Hchp@Ԑ075 VHuｳQ!_ 2X -@΅zP HuH ;>hͤ4CJ-$E}͈d@U _쿜/*A?̆Nn$6ߨ*~_$H?qStUs6 W~[pE??sЈeO,,8ϱ?Q~V!$5P ~_pDzh_2!γx~9 PѠ0`e+HxΣ "uTN ݣ/a"n7$F89㘷=l9rЀ d^ ^u0,hax)9)ʈ獙);̕ w89sN4T^j WEx/?/h;&R?ՆxʤR Ta3/ܐG^7rCB(]N_ X Շ1tP{/&*ؕ{S1?q\-kr~R)'Ž1sʭV\f2\R YݶOk4q|q*Q;[;fO⏳11t|:r?m?;&愂d,H9p MAB&rZ[l*dW3pG۹Mw>T OWGqΩ2K~o*EF UEb^ ͟8r:ҿ3gǘ@$-WfCWsH^nb|x|Q!&s??&7Q#*RV¬{@=}p-T~:-ց]_sЄ5yxs6%hlsO5"mBWK#$$`Hh zT/0T'}0Q!9LP'k$P5CyUPUx"p:rRXC\ů~O5|TMGy*fe-Z?B:ޠ< aC5b/DfH=8y7iIW: G}E=ɗ441] ?i{#UKUɃfFw8} 1/xf@VpTNW>-mg K>4rɺNW#0C~p^O}I;== o4Lm3Gv]!~3aGhpPybraQkc&쐧}B`xQ~ǩ\}G%4V5i=s*2OuEu^3O (T`sG1B{DM[Ox3Y#?ؙ׼\퇅A*ccݔ +T3,h{"rP9s?.) Z.3km%tTyu*dӒQY(WyJ,GAߥ@D{t 72|Vww?v(x5 kYG&72Y&}u ")67;e 3Uo~Kiz_- t῕(wB8QkZq @ Zo~)4~oՍ-ֵy{=!7k&ֻ0MLSP螣3f8gG3|{P")z5q_d8~ os_ءehQQ0'rϫ.ZI˲T*aa*l 1 |:b-~T"jL ʕ%`QalB @PG(M1$뻷lL,>:oo,jr'@Gm,E???%ic.]]ʌaA(@MeaHhe v2~>,, JE Vw-b{cտlo$r u{ʫ?S$6`&qny= LKR*<͛/|`>fǸxD@ xełF. tޛ(PmґkQ_4z?lVdt3XChȴH́^34)=.$obHPG~oowe[E,ZRL;ϦHKʤXRl5g^"w,7Cz2`b!qO]l//9n/ֺ@>Mĝ/nI$rYztH 50uR?bFGwqr2V 7Gqg,u%Gܨ/ef2E#и>"gזdk\;ۿ-43a W}+=}|~oO4C٢1^CaIswЛQߩ@tg_AР> du`թ4lgyCkjra$1S U o~4!gOPUhg*L7>-0iYFQ.Tʛ$w&@vOF8B-ly mbD;H$0*4w"?^0jp[>4#XEZ &<~mxTRF!玨o4WO_i|,1He) *}!GgE$Tѝ*A)}~({O`}>_{A[?UHD%"-pUdpt*1-ԛA@q_ws˾ \ݫ4 >t~]P|`dNunרOR|xIU>jt/]Kp=;gA&hnS>LeW쥂%)ܬeCZP %gFfwff}<6|.}ޅ)}4BN_Z'{yyw~޿z*ȑ$1>+*~2yr=ύm9'Tw$jLQ[5YRKVeY$ؗްD c(#ɸnsr~w-HK#;?wtwC0N9[6RSp(R]!Ap'Q̃o E?o%{w 1:bY@&kbrJ|_I$"v96 TX '$B Wn6Ô $yGw^l/4J@b@1# ';Q Q"߸bysF3|x+5Forj)ُxV"q-4Dz˒9V ?Nʑ2\dby3ø_.=5+!*UBD0Cis 7 @|G]*FX˱k L2Www?Z&UFSk *]ғ{,G~WKZFO l[]i@HT/d-FBdN |薺v7E%pQ|b4Y 1M7~H%jO#luNG8'V+_Aƾ>8wCZXE6 tPC#w:00qY߾q8 ?SʏhE]k{>:rGzrdtCV"`"D@JcgY8{] {tEC*TWkVy]Ҙt[@Onqɍyq1(`ǵUzBqӮ>?k&~}M7f/cz r_`i.Q)\H" TV,W'ki3T)KxSu_+ANK,aUZ $y썠 a=m[_rAP6GPzq>d&uF;dr KI5a._͋@,>l4a'.&oXymоUGOYrkB5w^ aUtL#_C^. rcQYUj4Z3cx@"ˎuf}MotYI:D6>][+)Z-~-?0^it !t$;{g!b8¦bL f5 {t.C͢2KGbOR9 +'j8ySRh~<sgL3tAևkx>.XsN:Y6Q^h $'à wfύUa<wFYXES%@-; d/}Br}Aa鰔7HzoqV3m3=8׉Ǿu {EQO#X6`(w;lig)y(P? ^GK9~|@<eBj9ws^s|J:g@AUP@A3Fg9}S"6[.bwy?۵.B XoҹoȜ$( (AԱN 1j77z9\Y~4ADŕOiIdsC;IhV(L }HHL[d?^N5QMnU'Ư6ݱĭܬ\ndU+na PJE@3-T%|7PLsT0O5^5־+ݨ(0 _ yF LP|z  I_ NFj<(֗N ܑb1JoSF; ?uSݗJ^0XUb&o',>mF.-8T_W/:61lH Z*:3|s P-PЪI Upr  5cbp-S$ҕA |Rx cR8H:ډ7Kxӹm-9|S(* UD-D[ݱ]Bz"(͉CGckGd GꪁOV$ƈ|[8}3 ~()gГk:-B3kO Qp[Be^ںz,NrqjHQ֦7yd MD@P\1zc˺>!zPow:/_:?6CXｱK@SLH@P(xDMl6t2su%yqBay<2V X[9B H }.Moy1!ʼnyS]X"&6*,cG'?fUxFm%oD{U{e$?c9?cl ZE>9_w}]j*EP?EpZTaC+oʯtl7J /Oܶ>%ni9"8tތCba9A@|D|9m[IoچJ;yRk p7A2"O,!'B4ϥABNa_K|Q[+Ԡc 42:x>R(.5|o*c >toem]"QX G=%41h$6^2Π[F0/_SVՅyX]kC8W.?aLF'Zcݸ@7j(ob!OPذ,R$rs);0!>)m`o+gTԫWMJs*1jpF(UވL){oGH{my_)sU{,6Ï@-L?3 ryFsATwSGԇjoW?L}8J2}GW>1\%DX}X|Kv:HAi}+zq>F^ՒqҜ=Ve@*P ݺ6U~Y?rwڊ bڏK~{og}QۊGE,Psg8@z3LAN MнQQy:GSԥaяѷmJX&s ej_v65KM}\U[ibNǏa]۱MH,7]?`z< @#pP1ʲ0p1N#4;i&۫DD@G<͞Pd()WXؗrAgPSxUQj(d4(X8IQ|OG7~cE &aAe= -!pGQswmnsԝ+[v`a=A!~1IMdpBtۄQw Ix-op\(;rc>9y.KFMIzJB9T~5n nr$':U*hvjɑ9Ɵ Y]r~|lSk9W&c} .Xa>1f9Yr@%}F,ʶ)كu>_T;PH."#ߛk%O3LxݫZpEՀ/X~ΈLݘ`[6Zmgi}|v ZA 5"1%ƑLn+s+d$w%Z?Kh1ЩhP :Ab1c> WzIFG73?qǣ+bUcރ.`z2u!Gd_OˆvBa]cIaPI|"\&(xCV@r6LZ직2c!x]]6T~rl/8Z}MsWg|(r;ݾK怑L [aA^)5eɾW&'n_*z(ǗƄgq d(;o.AD>Tv n?i?/)XxZ'}WQJe 6-PedpwriqcS Bs˭O:*0<]>5 Ӿ3·~>+=b]۱hZP<4 s&?-]7μ7Ѓ FaC%Tn1`1n $"-P47 ߩm+E-m@ l148T]q΍ ƻ#Y lsDmks;S[Muzxvo˹8S(g[5ǂXj\= ̓oy2*fY=VHmaA;7eK3`I}e@Z-K@c:3DzZgGnz/g c@QV²<']]|pz=q;IV*Yz(?"GPdaNcyoy^4Yj"=bDi|:TLpS!C\=!~/}ϫGI?7Y+pc66T_];acQOPB P#`|o&)A'vHHb 5b0М}q`-nu2,\|C-SHsrlNW5 jp&5Mdkڎ;0RtFnZ/opH)ݬ;UhEfEТ6vӊIhL~7Kujyօ'Tى7{&ة~}-,jdl[j@㉶awƟHBߣ.IyE#daڙLɧ9c2.2RCD*AD |\f!բ E]fԑ~g@}ayݡ{_(:3vx8$b]-yf + ^|;@΅Wb%!wl}bwy~F (zLZ볃aejK~f5}Gf щ_г%f5{T;,e&S K~"@/yNlgP^ZcܖJWD!N4)buH$qp⹝2uABH5(AoQ_O| qu vŦk(#8g*UF<9*aš#'ycA> *e;0f(ʠ%@z77Huv>Vi0 uJD;ЕI"yz7YFkB΁Lq|M5C-C _ԗAc^wbf%WR'rE4hW8y}iwv%3O+ ;(+ {>=B}Q:.|?2lu+c%9.|k4c>z*/[߅&oƂVQ^myԠo[m< :ȅ9v޶y tZjO+#XTDskFZj#WEzMU fǓ|Qiu 3jBK+uo}D53gգ'Aag}]Qw H?-|)[]sଋ嵌+qPC> XT8h]b&ʠ_(kEwKҎdϢ鼓UNexމ?lj9teLnO.ܛQ?>tL{|'4u(Y}0[>>F]$Z}"(zZ0aUe/23$Ea{¼ p !hSҏ*⺟٦tyͤJб2֤^cXt!@l/ uLM _xNм3ߴr2 euK}}o#Q׎^.K}t2~#gmP_?(s:FwuWy:i?In|&wUd5b⾙4EbJ>h_/.k =jUO~g  7z0n IFxnbÇp(<9ﱻafqhù:1/IYR~l ^*3ZD#p{N!x ^ KN!1__tyE->$|22~jLJz+ЄYGۧDJP~aW!'ߘ_4aIl*Ca΢b>PTub̦]i(g:<9OM!-;x>\3zPjm"b{Y婻Ў%&?*S^{Oo0dlT w/ZhD֮/_xYxhROh&G¸3 yGSܖx'fsfs=VuQufO?u',ZWȟR|&{*=22+A6:flngǑI)&4"Eժ1M#]4(Pg/iD&?i/k*̪<}SnF-@hhfUv} R}lz"1%@`M v\GL" R Ӹ× Glˊ8R*x^:E<8$/MFf >['=4ێ_EBĦaywF=D#Ӓypx$n~.TM'n}vcy^ issis:^$F|;`G>^ǾPR?OCbϴuS AKhƻY { U.֏_ F"Jȃ,!5ZN5N{K GB^R7aan6`y0S,~<4(A/LP,/ϸ')jC*@nk: ` D^w0"3ϥ  HUeskP@~d:@樈{(}1DD~W3M NAԸJn Xb鶁P=f_؀A|;ejs[o)D !rRQT`ͫ&WroRtAEX"DAdR,POo&(v4z;vK[MId-|>s'p t: i"^-TAEP"3\|WQ na/{A?Rh A c 78ݸmG??D#AFm6j7Fepa[??s:Qc!2 PP3V"wRA@Rrh GY쓜LF H!R .H {hND>^4XtHٺrU݀D [Zꪻ5J0耊6֖zڮ<64 [$0f#e6hIsU`{([Ԡ]:#R*XFngD`eA,I _Ex1Єe1AJc\i`X&Z `0(;~?_5ξEFTO!+oAAQ@P,$ݣ7wsY-͠l磇ÝZBtv)Ӱu(T鞾@t*Zx6_;#ޱ ILo*d+ ح০'e eVleC>\%A}ҏŅn hpU-Z4 D^ p("({|]g##`ExN9۳yX*m?K%Ɋo%z^t? l ;\!\fi/o\0QQ=hV -ܗ0&@, *;y6rDd-=K\KuC9 @PIP Iw?\\F'?{|ش;X& PXr$;suJ|7fү.-mwͰω͘^K,QEE$'3^.FNi(R~ŤߣA/kStx L@'/!yﯶw@+8E@Q4j_3 #>AR;^UM 2}]l’Ϟyp_;M]e8#YeP=aB퍣"Hmޠt I Z)n'0Q*cIJ3ή I@XZDJ@nP,UAa96nPZ $!wvxPPy܉w=Q eJ 03 ̜V'ӧk*,sWI֔Y*ߑB2-,VQ,U3y,3{>>sy1tHA3䒞SwYN1%^dx^PhA e~sh"*+ RvHV2{ʡK.r?1Rb|I6:5L3j{0i'"m}dfO:>Ə#~A۩CL @t) S%+ܭrFQž2O @6'C`|b%I0 砬BY]< {"1m*>q~G J,YQ`Fe7ҔT<.DQEPhjjUUXYEXV* `\%XR^/ =;ɱ C!iG#$%94l IƂJ;GMDU0>.8v/xwNyb->vjjӳ#SF\Xv2(@(O""iB1׻!@h$'vƲI_ Cwt7 Ѭqj~qmzuC]!`> CTWOPRŕ}fkpKV fڀ(_2bʥ*AQ D@9hB*qC ^rD#G. U޸cǒ έQJ(\؍Ǘh$)k _6)IQ2 P/ף~\/ܣ큞GSj;fZ5EUDQ`-"Yl҅F%jҊF *V֍ck)JT-Kb1A -l(L0@$ȔR+EPM`P*+I9N SPFq``Zuf;m4*=v@V2ar0Ki?NA@P/cV] r;;( 4-( %9*yR+*i<ZPГĈA%=gR!96SLPٿ![y(>tQݳ|:xW#4eZb|QX?\'ʚuM[3(2PY.+(jއ\sn$C uf 2"OyQ֨/O]!Ҁ (NdÝU'V28 R]>tjyC'xs] f :QGƓ(o׻6Dyh}*9l}=_⼝MZ5Mˁ i{NJlJur6ǣ22l LJsۼlar @@ tM<Š"*()+2:B'uM ɱ7oZG<= z~["Mږ%)Wa9^u6]-Qsȓ')CF PytfU(HG3X5LWPI˘hS"!IEJ))PiZEҥI׋n"4oqgdw`BnAŭ'F!Bć<'Gx!06sc;z.;'Olqї4>o~&GSF:" P)įb<'ln:Ert6wۃ"OHBKtT| ֆC>egԈuAw!2(ϕTy0%ĞJEt+7r%RI5a~K0LDxOﲲL+zYNG z@0 %lfk8ι&yO^RARU} 1<9ϹOv[/RDDbR(zX͝z|OU¢fy: M&Ȣ7Z0a#2$]iuN6U zZ(5hnDv=K5[M%j?Pt{a .KIX @1@Dzt,Fe\pUսK6HSCZIVCS nr06ҶYj'= Έ**ıd]i%*md $y''GΥ-h-:v[A@>t^T߷8q ;<`@ ~1 УNR ]T]'؏,gauI\Fɓ3KH'Q5nbquT!_6Zr[ae,OFiG {O1L7 W>z@AZןF=~C2ɣxΚ)vAvClf w& 07 'ijM#qvcX |tAn$wn[z狰qŪ,6`0Iq^>N rafmY Q:5m93Y%$/,th wxAYg3a/RȓWV3!9nh޸0re[75OI6F%JVQf4h@=x3:<("R\_ W[&a DN`I!ؒK nlcOpƼ.)]#ƛ( {q,L+cA ՛ KcMg-Nqab`*k:tke@s|>fL&=[iP-Y`cyi,ڏv(1I𶫻_b8?vp @I:5TZ7_+'Y` D@$ >]bPߥY/xj%xhJ7+cH"J.| c/Ŋp[z"vbw?"bA3/`f5  nRXG'T˸EԶfz|P?n!mc=^ 92;uӣ&{4]Eۻ~bCiﻟS>:-QkP@6H~T_RpWroː-evҜ~+WzQ`G .&Nk؄PȜ1䓌z?X~g\(6Q\~4tuVAV!iև_ BUSyr\{8!І"϶ZLBiukyhve!Og} j,6L[і9 6~Hʓ"5($e!6F/CzX VsFË˵&dZRoGn [|a[M̸.C$SJzz*A:͑  )7犂A~bA\fեKn:ysF!aLD臍 )3՜94SÒ^MkA"5 ~}gBKwY#wǢU)Hۻ>~3E{&,dqV 5AJE`0hFL_:tFwԚ64Ӛ{, ~s3w%ayR?.ո#F*2*>5`o78vԗH45Fuˮ{l>zTZwl"S#tX֛W(7S1ø;zx7gwqJ+iAw@MB5Zd v,9v9mN۲l{mE@D?0u*Q2`:'쒆@>Qyu:3@˅NBl"<Ƞ7d%+ C3#g&hCٮFx2pDHE@"^LVU ~ͫUIv ?r|r] 9 `9 H@b)ߓxi'}@KRRkk 5(Q|3M@ [խ!y^hl bws.|jP7"LS>TNg$w.g"GI$[|L}=DuG},q!4LΙFV--&֚6) Bx?r%}MXBxtnZdCA:OTM10ĸdeHiٹL.0"&H!J961U\*+iSq!tJZ30]/4IbCzwD(LLJb=Ev+#)ɐL͎J݊5O7׽"^dZ$ -: +>4wߘ@"(,oT)Q n|#v gdZLCw{qjFw5Fyѿg%TM-!,tC3O} iCE.qkQڐ UG:yk!rw;gB670Q&8j&-W(Z3aͷaXSf#VIg1YC= ȠDa @S gMLF!2IeGn G3jX`@g©J=H+rݯ*CS 5^VI̶?՝ņu"o;b-!گg[1r~#Ԗn֩y&λrSQ?P0f?{jv&r IxvXmyiH,)J+,,SUi˲8U zzt^br) {[rz@I6]\ܴw[S'mCKU rkh?I {O5 fLO\M/e[NGd[A=Bꜙ!^,ٳcp!dmZ):=cDZolh1l`XLDzm X?*os'Jt) :龜1&\fEF `! 9k(KE}c:a:x! &IA:[T)Cu^!LrF!H,% z%2EqyŚ~[R2%b BPbϽ>ct%`߇WF>InUbZ{ц[zX5ê~PýNΌmn|m)c={-A@J W[!@>([(FP6`w̰&vkqvv3j?X!A E*N2@jX>9y 4j9!IqܯŜjP`bAL%7. x#E_!u"bF5+ʧWAurt83fF;-M ڒZ]eiJsvw}<;_;hes8SތE*4QCJAQWGkA$He14UEUߐcJSov3fuk my(Ԣ[ ML(фOEF_kp3 4?hu_8~ՄϪG~yNsNfTym2j,=_`ȡ*i8W MPҔD/վw "j{x?Gv-0MD,TMQM$,4SULU4DH}ylji*`( fja$ՔADW]\/c (g--"FCep?3w3+k/fǓHE|ǜ}Ci=60YR,X( @ JlabDR{!Ųo1 0B\N[GS.c|/5cL) $ܾ"r ((ZWN;vJ?c Ā $4:Umy5E*Mju`T,O-XCC(`?h+홲nΑޅ󉒤 ﷆ oQS&^%ͪ[?[IGf*򪓙J1D ]*_ @ǾV=4!TH)Z}l0M*Hb^K>:h`Ѝ"ܰK9 |kN($a4_N\icWl9zOp9$4/ W=/._:4 {E&wl1.[IA_08 J=z|%B"D;S3MĀJ cSܺ㗋M E$': (=B&wY0bGN*b@:%qD]ul]wh\jJ+^OeskQvˮq0\2> =Èjճ&m[/V뫻 tPD=v]6ك2 ƙQUbdTRҒ"M& (++dDRrI)J-1Km[i(LBQ}B^Fx7m&ݲJH,ҡO*i6$!A iN,Y#Q*BȤna,c־ n(8\j|6 6q/w }bF cENPRE:+̙$,3N~2 v+S-&Þ~%8 ݐ0IXX褔$h-M;Sa;sF|Ykx["T#ǏLFs\q%T ( R(pn]8"KVق aGi uNvS]}Ѽ~~(5p5Dt+`jU@Y"7 -zf1\ƩRv(kϬ^ 0byA FȌ%iE\.ƠѰac儶dRH>,2Q2!+ PњIk!6%H^)7Md#PPg+Pm)e!eJ S;m6(P mEB" Gi{ﾄ Džܘr2$𵱞ײ;2gT $G;l|7xްVW3Ysm%U*w3QuIWX ؔŻFP6Q͌18>I=}7_1N9}ڋ2F@B2 oHH vgO5oM43gWN>=pM"Y1,!BE WeITLRATV *5B4DSBDQQ4QLIQ2%&I4&(%PQ 3r"A3R0IM4ĒDTD5M Q-PEM%,PU4 A5I%D $(DYq% dƑC "˖LX%)z}2sణ*C 1{7mERdnwIa 5^'6ޑw'\bC Wߒv"*کɆp!|} gT"øˢ_Ld EUd:]t%\Cu x""ZF & "냑gSn*뭦]*M{лyiq)EM.= ^{uE~]g7q0{M]mrW9aLڍ5c [3dU(,67ʜ'_ñJianK!y}Ob{U}v SFU'IEڸ|UL &H_Ӿ|T1TDr(mJjđAˎ[" XTC2 3w+bS`)Db,ݟc|ިOrҾ>)h`β!3t@x 0'Mw_ BsuCXUF>\/tMrP:b1\-߃a ]ZoҼ`ũzK8_Y E5ۘ_Z4lM݅ymJ.CdVd :OeTMì@P@Z<ME UBvyb #0U,ڛsڂQ+(w k']k@v/!эB*:iKn˵Qa9 ∲$~Yi @NTy{nF!s[4ުBm("y ը=>o9?8hȵ3bkI9Jv]h p*v CeM-0*6HKnah6qͩXM%/x~4uo'Wb *ݞ" tCpm sPOdktc0-5OeRʢ.<Q|$"1Y"U|^TC>v9Kϑ9=gwR.*B~YZG߸8#H'V=FmYZfF"Oi ۩JunjgG!w7 (m6гmD̵/TWmf259D\{¯ \i4F=a_ɧNV%^.|\}<޵2ٝxES|,J!:zA%P@;Q챉;Alp9?jh\'Qc^ ͣo&ZPy ]·j<ڀU uq+M$PO1ɲBe;WL⪈+Nw.qcKM8T7A@YD"2ESPCSTQPRA1AT 3"(R"g175vtx! )j~5eZʤs$5x۟O<.Ĩ˷nW @gvqg-׷~x5_B>!#n۬zJX"SpZfWZz.7kzW ݗ4KcT*.vŽ>e@ xȍ抍ITYqwH]n#/ '4(1Sq ,p:!J!!X!/&$ !#y۴w0ɔV]VZc2DYQ5pm@3! D -  w*UyR c+wjČ"Zs3%c Q$4QQj;OQ}'E5Eɥh JLt@H @Ca˺QK ::GGCJ)9QSo]a|y ĂB斚 P檐d 90K֫YgV <\GW0Iʔ_(~34S 4mWs/4EEՔOsz܍9Nέ,.q"!JSrj|{KT_09 "-d;YpJK* 0[6:W|}L/Nj ȴdQ #q zk4祇ϥA-$*>fc-K]RQW3VY&]-* T3"HTT,̱bQ`rtnb#p5"32BeUWc(gǨQhW6EXHet]ޢ\I3faPHD{ZS۬&!<;=;Uq "h @**$*,X#202Y&YrbH V,RRAPD4ER,HLZXLԱb(6+J7  WrM![OJnAOP_arw#sN4HP f(H!bzΙ͡5åi1QHAx--,A@ykgvq{YoGUFBҨ.&L;߮l׹S  s0=jAab\7F!\J ^dlHC_gw㲨b>~wuUd?1@l&sLF ȅ@Uw(ʍiK=UI*8^Iͭ^Azm @Ӆ+z0bU ݍHwܿl7osc*3[nPF}WrÍ)'eœp7bHc{&s?K;MV>o`Лz.R)kFq)Z7 i"ͬ=[iiൿF']8g6*Ng٪< l9(<%=8sQ⊥ XƄ*MGNꌃFo/ QR6@#̑.傥!܏g@("G}ҋvm8GyV)iN7SI#k~f>n:_"䜌YE; m uJj*(%⛁tSX>I@ny% Wb 7B+~n߫9ߡ vCEWA,F\ PPkzu-݄K&5I!$SY@\&P?+]2F;lYS|32;1GXD_Ibn]>hcZNV-=oKip8w:k^ͭ~g_khx:/F$((t'H|LGJc)yOƹ`{7 9G:h;"0疖b2G/ӬiTCa's :`HBCkGzk!Օ^W< @W9^pʊ0K*p"s.}[|Ͽ~ў#}h /j +"7jVNk֢S3;T$|w|DB'`gWߙy HQR1+n}Lz[ryõ}/1#&30%N8~G7ag3qGPe { |a%*p } 9w!Q_L3-.lcxjԶb*# Em;8xb ҺdȊ؅*'+Yo<1?w8B[.XzNewJ6"OHR9N5qiDBmn1tiQ8PR}M{fNEulkC @[ Kzzp½jq̐]؂8WZ iK-2W4Ys_g6M' yK~IE3$ бޯc峊 adBN0(` Dzã‹ {@0?MDA$К!߉J mՖg5*- PBN4>BI!Fa;ai;Q@QҫG?/g oS~F_\A^q %6!&G{ S q^"&Ddg+o_cCro_Bϓ֞$łe(b~w}BD?kvyCpiұTF$݃B!?ל?Z?o=:P5>' -<> )ͺ:~Nw\8K+|ofApGx=$:iTQ ~gif{ThCtlHB'_4@F/)r|) gH~-= #ФZb;"D #7R< k8+290 ŅHkեc+Bc#!EP@Q} I8r<1J /oxGLJ0Ձ$ ]W: oy @dlboZ []+ lm\Ϲ~S΢  4+ӧeõz9 4JSEf1\ym~9KX}nhK^5{n0`y)ι;Yp┋)u}K5Ps1(cx+e'Bp|1[_QR1dd5dZ#9FdFw[~{7vqxoFo-8tP@?fI aiQڴ#VvRWSt]װ;z`cq APiJ90\e}BvL$֌H,Vyv<'[ }:5 mr" *G5q„$9b*0(g&D-c!ؼ%K LlgIM+De4j|dݜ")#[ R,WWS֛2G뽑 fR1JhùН;}> ❈r=Dx=s̫:KFzD) h7G]/jki?׭{MLº~VOP\楑(D$avD%t P udY@zL xsǶ>OQ-ώֵ{?]:@(#'g>@Pֳ L)f3ɘs4U% R?}"F*~m 4PR"ik~}07T, 0dN`Du6&̎.ؘ/8W wI\I0,4%ڂ2lr,Hh-\b!"~(tNHD x)ZVTihh6 0dbm(a % B5)- ҡT!DbQWu`(@ǡPME94LM 2g+ (#ʖD7TAE,&A3UO/4f"~p,'TwpxI CGoc';?_ -!5h-϶*'s ~))"V)mrLIPE\{+b![p20QaBȱ2) RL PCLF!tm't=OI=&@j؄?7}c zUT_K4g;"v<_yӡ hFHOJ04%*Ylc3"L2zvn O :PR 4HtdBHdO*{>8?*Y̙j,LtŴpDVZR$QeFK(Lr" )a *! ԘI@US32&VV1P%dhYjX"i(",Z̉"MɦmU$|ꪡ j E?ݿSկ#g^GYzjCcE U΃֒/qC|qLI)UTDTLA%E(IfK*+)Ya$DaAPDRƙe)m([`*x5%GW$\yeqdMM1U 9&Lhw߈ 2I=HRjRm+dz}IEiD31D XeB+7& ¡c+Wgˢi;A-*D!VlA:;N q@CER4B%Hf`TѫL;TIIDM4e&dX[SJ&џ\ [ uV3 APxl .ʴyF'Rf%E4~ Cz8,+ߴ;K8sz0%(RnұՈƩi}*" ]1ݯ3D# /TG((F*._7q95|+ޟS۬fm9ISBmnmful  sƍlΈ;EB{;#(N jȚٳyhwݯb:Fo4@ODc[c?QWz2Τ2ʖ-Vھr{R 2V&CmGqw+*X{Q `FOZDZio _?/ 2=̗{l cđookz{%F*-3qmF0Y*vWܳj^=!ɏ)( UHReUL< {7cUg0k[1M{6;]34at2Jw`)ͺ8dLSnPmrB F+GQۏ5Iɮ$VXMGYs\,t1h7lke4txLJTpc >Lj8~R&v')Lsb]y5m '|o?[0HlDnwTi?74jM$. ,w-,k$ihUHYmQDE"""Xcci~֩wof"O;aByeG4r+=m|#R ҿ1C~ązʼn$չ@!*H@̀h?t?{^(1(S C;ԏ-no-B ~%t;M_;=W+ER*i.S'ܽvYtJwӌ>⺒"T +kC.in:x_OӧIP甆:LrDk+q460R(LHTKE2A"xmRIZH[ZM46866 &!iɌ2p ;Xvx)Wzyli/ve* \~=Q vi""Ɋg,ފ {|~g}^9(1pd%dQ>\L{ŵ̀<(}Vo'_#w*[ưl;)nڅ7Fs^v|A} y!>!)W$>ؑUh- :>צ`j" C/\|1JIĀiz B.c_$Frɪ ފׄ/ѬE|&Zd:}@qI=֘xXxu7m($_fǚv\H9Y1>{:f&J>{}:hVp8bD+ >əe&JԞn1HK(Qtk_^u 6[j! LP)"rsq.u -u'¹=IܙLY` (yJZB4^9Ej%`z0wF;YN\. f9:-bua(RڸZDgjh&";i%ao X Ԥ5C1/ HGmKG$nёyHz7:PΌ\u\ qE ΠA))``'V}2ûZ k`~"n`T/ j9wk^6,#aL,ݼ@XQ-봬yu+,/dCn% a?LLAZ M@ ]<RCَ9ٜ++L7r &T\O}LsÒ7qneI6yLXJ2[m\}XC1PI006l`;2)M.DrỆ+*]ȵ^nF (4jTuʉWRA/=鏭E^mزemv7ޟ<`*76bH7'ZRs]a;=ڙ}z<]ۭÌnpuޞ0t΢4&Jt:UCN,ӱWg~{}^-X ۴8v*o]`lNypUMߝ*!e~u^Mw1l^ZoCVx{)Xz=-ᢅ|1]t߽ޔfk/>"\~f׋LJv).Vœ!2|ۅFMUc&A/: ÎWܣVG&]5Mrt-h-|75X҉V- mo<pmҼuRSJKVZtL P~>Wcd{?g~ۗ(px{? oѼju64І!E^ :#wK^w$k%\cpBHBW$B;!@UDZ\@*v :]c/4~oX9u :;.ڌ%oQ )LK̼[hn`_zJbAnV\aalx_,qL֐׮$%TD#3U6MYQg:?0H)5?py$ T߃A SJI12 Vԇ4*5)DAeFXE3,=9dH*[B.pB)\@ATBnaB`2b$aDdBh6vV6a JԁELiJ[H JIT*Z ѱ)j8³ \@o kfhbQwfqe]ːMIM9ks !Q@QHd\E$̲H6Pio6i7$4Z 1P(]ԇLj;dϷ6MYcH9bbsBKJYZ[hQ eV*&& V5Pƌg pZPQR,[I* m>N>.X*R`VKj(%?ٹ`A2H+@蕵O̓wOR.3Tzl~}=-*k>鶪Z;لfA@K>fPX҇I% }M7JxsWtY+ϕeRA"FʐmD7)#|dD%zC?3?ѡAGCqDo|A_|hGJP^i,`TR<"׃ґ(I|.7ħk D˜IW>5# ʠ)+48K\Yk1&6XEREZ [e`-Z1Q iTcmj BGeRԛ#DLihi!PLJd2"-KQMItܚẃ&>&6\ :$G #:5M fl (d6!u0iQ1TU%H4fZ,BR,HPACE%&q8H,B*!`4y3G;DriW#>\SQ5AJ " VE"mY'\d[J6RFlX- kRFJȸ,Da YUTQX9-( J(PІ!T(Pb(U~(ńNjfa͍±9ie)^"x:+PHjZD*j"4L*Nm43C1da.̖@4A.rS0us5J  I>uMR'7i4L*+8@0gT3Ed$U"3$?2NIbTk!,uP44$ePʤVdcFi.i("@]aNa-Mp-Ar Pdɲ"&8 t8"Z&EHX0- i!7-B V J+hХel1i,ڊ(mFR U8U@iWP3L^eȝMQBFKnfnlaByi Y0׾?\﹊OR݅ET9& XVpf*#"KR!9/%* P ;`E9P+2Qk[((m8L&FATLuf+pb8XbM#fP9$8Q#4z\_w0iطΟф$]zX&; ][4"Υ=iS[U'7* Tܜ3y/q4rک˃%sgCxs|*y}~֛QjH3X~}|$r-0ZzȉK! N<[}W8i9ͪ(QGi5]C"' 'Y >W~ !3ldUī"%YLFӻ9?#94K`) [\ONOTvLZBVJ!`7sc=t챢 N?7S" $rJRTv}5 P {`F!jKhb6կb݅(~(e½.?.pꡎ8|!Iȵ'gy&CwƻL]݋O 3-9,~e/ myX0+*|?-.5Χw~uŞJwknO]I$e'#.gx^&}NLjwt;ڊ8yod.c?6J/~[U1?#q)EbEz?..'R(x6w3D)whCg\?zt~)Ƭ8nrƹnw-Ж$dI/wɛA.ẉN8|? c7J[c3ķ~TN\jqN:\ǂ+O{Ĭ/֓Ď]M=jLeޛ|l܁h%?Q1?kS"&XѵZ]9'2M]lkNSŃJRrG c~,5gp'qf::9,̃=(sysei|B|1hu@ryodPT X=}ޑwSۦ="YSlwZgm&{iup"|qaUHOv6e*i]3/oVcg1lDjiQ5TֲΊ|潦%]4)܀<싕Ŋo}W}=oaG^cvPQh%)@GlL!!ܛ&|=;a]mwOQKwmnsr6'iCX\adF2)#sMnL-w7 \MT+lq@x piA-R6G0PL,4\JOY< 7+fO<,T-(Ib U#µ,R"XArTNsOCތ?~_! [Q?Z>.h/0b(Am1Cf( ?B?w!G/5$0"Q1p {)EhQi ET6PD0Niv`,4Qm[lϲ];rfW!wu}(ң8 0nMG^\t^F.[`Wn5|[+DP#{_9Ks-ť"Z9_m{PYem$F0}ג! 6frE@)Q@yzٞ)\rѸF~AIB0^}Y#DU.MRƤ],p}$0vx/_(NγMyZgX4~D\8*lOt[ʓM~+IWO"v_^̍0;N2X׻h7Ԗ& 'ivK~^Wrx%*SSpyMC !>ͺ(4-Qǵ])82yl@`ڂmU*s6 -D *y4s BHXURDEf9L4Ñ TF4" Ӈ3Ɓi}~֍[c332me#:OIHo3 XW "1J)Px5\'݇ȿLƂ%n2D C-WVlpͺF rRc1-*BPm(-զ)M g==lzqjQ[^ݷ)E f8ķ~H0 tE@c O>vh݅Yםi z# KܬE.5k.stw}%VUb-ml "c%@EW rwOcL`*1`OR >ldB UN Ekֻ{|T ցFXf21RP٘EK ITRATS5MS l]6b\͵@eO9[.%`1$3{ |s[Ds4j ,p\aM MV%O=גnkY]~,]HȍXּSa{|=](oҬ9p¼S&IuUF1 QI =P\( O%@NË&Xr4mQ 0$?+Mӫ/k>[K;LN}$ٓ຋텻SuynuAģPt\N#f1KK-pۻZ^s:wj%{ cwݻzu\5çB'2Ǘt?NO&tR> hwOdh4nt>6 ]sdϝ{y 4/GSW+Cƒ7.L=WAחV EkMn=}%mi^ѱ{3/,\mUmrxxZ=?ufoɓ6L d#圪:K~VB'ޔgdmlDիdWN횓oPƻ?7Vj*XZ8-vY(v#ŒdB5JK-(ЁZ*W*LX_J\S:ex'Tro,&טFWqK¬=[1yasU+=[.{lDЎ>*+W*#]Aټeղ;_`ٽi˰ ^uG4sERvOW'#t".˅@א~ڣO>==dr+OtTT_:eI]fz" lM>!벯?!x:Mc$$T],1=2x/o7) K=!2Jq$2 $))Z40߮tT&$lSÐ6hzGBO h9t[aή 됓sL?a0jJVFs(}FnkadMY (QgcoY:'Ii5uڻj2?//{TJwdž̏Mz{g{I6 r y7i-;d+B0DM-&H%0Q+), .h6La)F!dln14 ʖvf|6|[bM3iļR ˻j6(QdT{D A&ZE*UVEH4B{"lw]{I r+hV>m 4NTBD&3x%Lݰ-]+jW_61԰ D2#0d @/ HҜKNڰ*W̓ M F$GM"!&У1IUl&Ҳ%ZiSLIs!8@Qa,<y2Cw9B[~%;lXDP7P7wO`>6,>e?c͏2wDֲ]F4Xo5i ԅ 5I d6V  Jh)*:QCDR$DQDI5TE40ERLı E!A5-.'~O(r[A!~KX4슨1M 1HS\ _h^|i'2.ZWN`"rZ+3z4eG/T;^ݫB*mlB:a6a1Κ ȚQdDꖷO 0s M*fd"( Z=|Gw{~l8O]sP@/$I+en}r7#Ad_gj8K8o%c .-0k&f[r1mf[I"dj\7V1(DGҢv+n/Ҥ @R7M\3DA>jÎۃ0?=/iⶶt'ZF LV؁iV_}jfwN{|흫 w G!&<Cg<-.AQ4EA!뤂0FXE -)w=Oi)ZMݼ}|آQyٷq ,bhFG F=IG+lAd\rT۰,cjw?e|G5 [ZRth0*0341Ymn$Zw2+deC4F.SNHi.yb:h(&z]W^g0ihߋƷrS BkpQ5BC/@LJvfϽ2zsG6$TEC:1Ô4]sQ@j{L@y<[:*5kVʟW~t+r$C vm|J5>-9z}w7ذc5ԛ(_TAQ<5-4 %L3M!SSA0PR4@̰A2ACM1#MP̕E"DDTRU 3^_!"Pxo`,zLZ+K &':&F&"(iJb"*ZI* )\9iJ@PaA\ NN'JՉ*$(h"EK8@bU {.VRc". @14,`c1T,e f2`.ČRs'8 h\!bU(,e32YXBdV5HqA~&pf}gZ[kLݬg4A"RRpom h5ZlTy=2A7-@ҽ|`((1.hNͯkPPug [Vyprz(G3,einx~)^lsnE%5HQBl6- Rg,*e@$C"%QR v#HDrD^C$T@ d H*! J* %"}hT5("( !AWP@>)SAe=^4܃0ts{6Rm?. 1.*e 1>./ok?(fV0$R%Dc m7D9R*D* N T`9GN*ܯ8M^u.@ʎ?)>&(1 hQ)p DkjmF\s,}-es0f'%r!kzr<F'|ٳf%[W6@Iz$pr(=l}/cr=[֥U3690"TRRR҅$x2a\O1iH՝s(&Ӧv8+ode53VjMm-Qֱ& ݱ!:;Xs (Dp R(uAxF OҙB8`eLY(,CG^C=EIaM67*lDԟ>8$TTKbUW`̠ܽK2#EU5QTKJDPKDCu9ߩgk,ioE>"޵[[ B-(+tKv6xBJDYu}g #~=n sc8F)HY(VPcw''&gPXI(Z w;<fȣX}\G5ciQ3 BdȷOM=Ȕ )B-Ic*CB􅡻DL)Jf;0@8[dS744O[F%m% =CEٝ3yP`j'l8o62Į~ 9< uKtNNM AYv1yyÑ3-Lf{Ǵjq4mn"XmlQVhHT+תNZ`1a-p_j.8:F,<4pÛ9ZɢN;iTbiC3epPaƘ'2]*'41P!& %(@$uǜ-(XBuqE΋q^@NAě]OO9&CSD e9Ul`04C @!K f(f>5 mS'G7t$&N~OVWquժޏ,_Z69\7øǓm>|s9'^:,xQ{5;=|>7 $z}[.XoWQV(DBQ#(CjFv.*~Ӥ7C^}m2#*"R'#EpH+BR8P"JH~۽Ͽb'Z'W-ZnOI%BxiAƞAHeDsLtY yl()A/6 'Wa PPy13IҨ5YB6m&Hd77A3$6 oT@^cL$/5C҉ 5ȓ̈1]?/6qpܮ`*VjNs@,0ȫ.*f/xQF\\<NʠHirzhX0fDD 1n1/Z4G; "Zъ7;}0` [fxѝ]5B[IQj5A TR.|K[>C~4eYE|o:g70I^&N>NzJ'Gr[k hT4oZBј7?(Lz/VG!G\Zڭ786jcד4K/FLL$CO+;ՈiʛGJ/f;7E৉6T1&G.Oʕ(A?+R^qzsw1Ai6!V9RI.Gxs܏lg؜?n"%$ fc:_FBywčp؈'A˦ lQF+fe~X  Ni{gؚ:roe؁Ձ(%d`Cz/3&~c21 ,"a5m՚RKdM$5&uML@ȩXu 7+Ewt0:Δ틛trH<,屭ּWb#uӹ֦I KBIzRIXW͘`J -%h@Iq!9=ɦ(׉eHPPu$ S71\OIMYY&&Ydt dV1RAHSjzsHjqJe(+i͘2gXhDQdEPh)$D24scsfE&2c%0dž1IDrQg QZB," @)(P^ISfd2OѠ2J@ ?S- msd &F[lC1Rhy I8Ha$S@mJ @'Wkq ÓlA,ى'ViE;J mb2#N96`"Z@FO3VTի qwHQ{8 ("'#0,hdD E8R^0PX!cj( b.&GVM05KDTEFEfL] F""pDh42ERTt c#w2%rE)fIҁC(zSd7di Gm`Ñ@n`%e`CQ(EL %iZ ^ffqPɤ puQ`8f.D/XB)2ᙐ0BQ+H!)@(YY̆# >@;L1!T4 )JҔ#@%riZ)fH2H"(2)I$%I$(B(b|$JZFLL D"D%d@5yFb JZ!*afJFe"PUca#B&E4% 4ȥ!Kd @RQ3Ʉnāp&>r@@0BШvC4"R(HJЦH! @ =P&;ƛJ(t+h.yN9;4@eԇ vqt~38$$ãY8 5(t CFRʮEGz)*c8DAJd@]E J]q7{cq^ 㾛SnnxC,Ѽw( ^*`PQIs[к&42`J\k\0\qBCG)G`:I)X* TwvoN$ yX5__~1V.S Mb5.w5o/F b#!. Av끎y#9QrN&L"-HS%2CJ(UO?`%ƒdhM{NMcj-gC ̓ɑz}k8ݑN?/Cw/ABlMQ $*ZAD)#jtz:|\k-bџtehg$xC{,(:o+$`*v=QCx|i<=>;I˂;M:Rbs{^-|dŃFq(VƉ2,Y <Z鼥c}Hz*/MHIB^RB&v#YHe(A$'8OT[^`n 0si $ԡh">gu!_BPIiFٓjOrDSSZq M <^L{r\8ͮ൹Co!+}X-PfJTaȐVr[\'H{x5kn5wj%x^ۯC$Vd| q UV3f>;>{&\v4ߛӣx=ѩ CcZ8b@!a ._ yѲJT~>d{n|jD9%懧۔kFҝ?8g U*ϕa=z_$R'4#^.#\Qj~# -ΰYhd ƺ {:ЇI֚\ٴ8r&x Z2恜zHlq GZ] @Q;f<Mz>menk8T=g~|ة"Eouؿ5p{P8ݬ3hytuzq'Okxv-{Y"4~H<4w%@kRуJYf@`\~]G'e9߉7QsUiGĽmEfGl-S~tՊ5H WM_sgA-"DVD~JA!4Q_1 O@)`H9*& V} uЋp/vE-,P YEqGd;ܻA0^XTY|FӮ.˟.l0+cY5nTC2 %aa?kA1cau EB ,,B a#znD݁Xd>Aı6`Kil]v쿏qc[WF=:g?Zt;*yüf`GUv֌%糞,|WeAb[?Gӣ"(P GyšKߟkWHmXHIWJv pکJp,RhJuXA 08s6^Y̬ \gEuVR1*y*p2Ͽyɔ+m3:vG.o-]' R4I$/5ʓGO:X-=ȬEؘJ ZT )@+5ݎ<6\,tMZ _f\U^؃SI&34iqIFvc[i3 Z \Jb -UZNKi{/+=<ÏϹoC˗\6ӧAYjfc:vS#'~#S"%f̓ɟ ZtkFjN 8L;qu%ǟ@ҠxZ/]jmieZ<HBYTTV#uޕpX&w-4/YVݜiDf4'˫;QWxWŽwP.\Pgov4܇և ~E.7JujH]aIa#ʣmv]}Ee"Qɭt/w{G4TV$uu]ܷ HT<v&qiјA8瑌zI&x8U.6|hnklQ+7kΜs>n<G}q8=-/Zou!=W`e,0j|~ -Rld!tGy iKųС.5r%gy/wh~ g>|}HC\H'-`% OG0jyr ӛ-@{Wˤ)<>>M]%݃d2]'Ծ0,5$.H[V w3!Y yv6mk -rN}xAb ŗ/60l2]WN  SoƸڕHx&Dշ%r}+(2" ސ!?d}T(G+ *!ĩ   h)RhbPR2&Rlg:{}eIGqp74u9TcDR-:&|T~U" /dž8%K9aNvݞO->r{ъ~0P9b(;@J="t҉2"3 L6wlXS&AeC ** 6QQ=b%jWwisH& 0jNInNü62]'Orx3mCS -.&QcT86w%UzXc] }J HoL;c4+AԆʢs,ƑPLNV QI Iagu #H$PQ:\ ͪ? eC?QfqR/__O0dnEoK \A\̡5ͱBŎeW•M> #gMͳjV:x}YEc4,CSw=K)@/^+*AXf:[yJE4Q;3L{ yJP',lI5ba.Kj6}a22!]ʄ2tͲ^"}߮xo9n5+A nevT돣|Q>|) )f 40}e]L'FלܱEK ;^+(Q.b"eH mI0L\l$kZl#"! #Lb>=ntRg?c: (jsK1K}ReߖЊw}1A}sH^1E\a9!zvV¦|VTV~{TuP̍ ,& B !-`5uusr%zyQs,$X,G'çNVz]GvwnuƆ(Dp5T0ȳ3*0$ci?c46BbHJ G/{|o 0N͂CWQ u< uD[ɀy/64ΟiT;2Urp(#TR_@S,uIJߌbn:PQBjW j4̫$f"ʍs,DjNc* ;-_YEDPO9|F'&O/L"~Wiw6 -G:lO`F b{Oc{_s/W?E+8^aә`9T͆kf$]`h hcW!s}[Db1IښNţ3p<inџ %{םE<0?LĈX78)E|W5PO ܦUN \aWHmB:WT!X+k]Dכ7_\Bw)I*fL4,>efj+ϐ`Fn?8g*(-ND"q,85g&0|Ų;za~1ŋK5oT6_xa/}ty/whߡAL: eLEAmL)g0oֆåvi7Ѯ*7^PA4+xzl`\>#*@KT%rY-V1l"/G\/֌4|}m#6} Ǧԩw[Մsu~qđ=ď&7 .ܱvG<=I$\qg]J1L%B*+:oo;wxˏ5CDBc֪c[A$I?Z:l{j}Oqi+B53p% 7o 8q}`ED C̻99T)3,Um73N XS٘!dT*RYN 2SfUhJ9d US(FӀp.8v"]IƵG2P-A<Nv[`3~"׹R&xWկeՖMzt\TV -eoXԲ.R9νoB?<?XY6 U5gJӫRˎ tpvqS2ӹj Ki (V*z͠(8 O- cfdOO(w):hxQb[5yЫ9B5|9RiAu Rpō(e9̓21NC.fI8*Y9#@ Yn @m./Otne"*6o xՎ@ٵ$877ڱM)ϩw݈Cgv"x/"-;M++[\ Bº!a9dk(u̾X?󬊬URKVА /n:֤bWF9&YݧɎl\|I1Ζ̒C+k^\OT~EJq<5X(n دhp 3<nF eO =|5c9DTݿ'/FHA,cQ";n`(y.(|6j^s;\O__Cdc8UD>闁#vw[q#AѰiկ|q+im)Q 5Zwe \-MV:<_Gʊ@E\6 u7^H}'X;?jlUĤ:.F@ۡ"͔&]Ϛl}]!ܑ^!QtZSa42VK,Y5KT aX֩[h5PXA`?& D̨Xh. <+ x% K SL3e0#YQJQMKepMJsP ժ t9n +VkSHv$˽Bi%;4Xl n0IJYr }I&Fd;;4L6`~wjHxI0( #fӘ} mxu/wTh=(+(G^*@L mJmnd{^gb^ZlSdZ5X>.uO ({$ `!F7۞f O:- dז紛tK!j;!ߝ:=o;7,k"nވ;+*1;CKlePTTb9P4 '¬!Ǯ-hi iA|Gke_[~&ْu {׳[wo|2'M?J f=S?rшՑANT7TK\%O}<,!.}p'24! ج9JO))8-q%Pye-† S6om]܊lzmkj铢oQQ8%C$"P@AŘ.V˒UݖFI QYYU7tEEm %l̬Ij)c) f C2iRљ5L6e,ۚM⎳ f^

+y;ޛ J$BaJI?GNէO v _tf}˓[Xe53r|>WKq6i~ ^TԃٯrCv^?c`M;s,Ӏvfˇ^7{gOjE԰[@ `8{8-q+W|Ly,Gj9t$YH ݰ"34X;6Nsp;jB" (} c!?o7bJ>/[؟|=gL0m$%0 >w]UWCC& d3ppy.MO lxt ߐ{&vG^4`/WT{HIV4 Y׻|nJ;>;1AxQ*(zֆiʓ ˍe~ma}2N :k 84z!Anpl*i${$ |f->/@O0Iaʈ9wxy9IL2hUnt5uab`C)&l+1&&_k!}&ҝ`umdI69CNwl xMOnW?v[373eŠ Bj'W:fRd䛘}; {Bq^5ڴ4dRHrcY\w .Yqa*훁z+ ^ Bm @1̻&F10uRrZ ~2H5Ȗ@ N] v',pg||AQכHf_Yv߃KJ$@PlϼC@wd Z8onڻ/ }yx#je©h4,USë&SçkvSz9{Ƽzݝ~>Sw|z}bsu96\ǺgeaOy7'i%+dX4C\,?l-i KOo'd`^h74F0S_P 4\!̩[*OÝɋԝlb֒۵~| k#nCɃoUg+>4 ,]x.1g:@Ö~Mzo:k:O?ˡϟvscٯSىvd|/W<4& vr؛(TFc?E[Gx{SS]kwn J!l|yӏQehR9nN4myNVTMִe3H؛LE𴢁d~'KLmk*1F_,PW[ztS @$% B(12RWW(/Of"_{DOMVQi,jhZj4SZ{s]_N2?#^ @jQMU R':& m57?̅ca9foZ- cF rmSI$) A/wFU2FfAMMߑQ gHo7PVAO K2cou,"2odHH~0FeK NN&:bӊkpP$ݔ[B"@I[onoE TܶHܢ _uoJIA<*Yb|wڶ['ˋ.kGE!Y =w[ÓA+mMޭϛ9Ԍ"KDm?q,2H5 V% ,(/W D]DQgτ5o- qP8 (I ́w*C+'Î#e+,q%݅5P'"׵UUN 0dH$U9;A<0==+עy UnhI7BCۇTB9р,D84 #6[Yj*s-# "er !`UY/rH7eL#Iz%[ɘ53 r2ȾoV]w/O7 Ƣ[PU>\뾬8GMzZI2:sZ h2)86v.cn*RPʩ-S0p0,"V_z}{=o^ԈEV va*-ݥp߳tYmbu2~RA-vI\N3m5V5[dc/ J^s7`K5nA}yD:1ZI7RZd3oKJ*+1i SF61WңLjVߟ{0o%嵲H0yٻm-q~N%JgrݩD L{^ 6MocدATl> 2iX ]5HVҢL{ũ˥uSb6whYv3g-Y57j$n8:yAc73Y[Zӧ6~s gN[wZzl8Vm;fqWNo6ߖ.ܭ^ƧQFہ*moh.kz*7N!1619!_얚tQ1]@HqO7X$<1U?–ؠ8 3[HZw%$+X3=uU/yħs =;@*@йc>!6w0,&eɇrKȎHib^mϮ.f]{^X1 -)?ɫ ZT>lmW`lrΚk4-Ӌr7Jåɬ` -D%Ȥ LflEX mF*E\&0[`F1UńVPBim*m fXcEP l LbJTTT%V!BoR9Ovv^Jnc;o(QH7$| t_U$yڣt'fl0QkE7t=#yw$׆[v@|x9Yjq^9;{ζ!}.n+Y0Z8-1S;G<4JN]g$6˵d.Sk-˿~( G--óKeF (BapFؤ7)Ҩ~/YsJZx`/|3Ǔ#0v4:x׳zPCWS`+ɷZqYPa_)6^ϥNiL=MaOp\n4rMN#\Jd59qV^߹U)aTcÆVUsaa,LȺUı"U E}L%eڑAecwSGtSBLW/Kyv!ٽm't5,+=n)wZvJgLc/p9//?BrWU^_caEba3A@xq!<EWe}6-cz\kV v|Ǖi@e8"%J0뤀DQC/Oc-j[߫כf-q>J3k{HONFb]wwkoK.:[Y0c޼ @IuU7xv}QaΎh*M䵥\ *Aa%VyYnd F2":!PZ4f e!r&\q\L L1 Pʹo|ٵ4cg2+/}ßägSnΛ_pZ< {(3]ĶnFgueh"ڭ(,5b!(&@$4Æ[[b{f{R( wotŦuYZWomټ+z6jϏ tƐ;NGǰQb%-U(mMy}/-ZX1= &b0 4&0W1;2h:PEVˌik=N/aDd w4VZw iX.eQ0+EQjCǙXfAR=*Yr EQ-%mR:hiw*bE,QQq,Ls J\q+chՠf1ugxSU` T]Fl!U2lVnQ[LA]w\uPU)OnXEK%xm˸HXڂ[`FIc%kv҉c5dlJҊ( aF [j kjakSν-)F͡`!T|vh i CU(.d7vL3q¦cK*\W J6*J&g *! LDgu43V\}&Ӫ.6B e5cGie3IhsF VHeƓ!冄{7 niQ]nbNԔ3׾/޿<*NQ%j??vH w;2 %=dcEt0dUlE+94e~eSɠɕ~F \+ 7J6ss QJMYFI^=9X?p";7MޝF/&0)@h%P@I(  fydprtIFeQE5V akDAv69 ?/I~G钚i|.}M^ݲkڻvRjB,d|^hX7mVKP5GЍ'|ya^\,%;y xo۳T'/gma:hŠ8r=DVZޝʽ sD6@? RoaޤK}DK!lõW^MpcqOpk'ig{N;,lѕC؈+Yp>e0qUc/|%p౗Bi4;ոz*dT8+l65IDb:HPj\Ʒx0A), N aI;}y4u-M#g N3r3B10U24Jy.aG \FXlQ_**rQU6G T\^p ?RMSaO˕]:i_o]0TVYZ\1D%[(˃1`A1DT02(3T,01jD,VZiL)UusZ9J\nah l-툣[J fR 6ňJUU+`151V[FDQ"e3+b$lw8=WYVBs*MWw=ΛҺ,g15H쮩ϋOU4#rD~SlCT .[snU[+%)( @nX&!6RWF7upjxB6l0R8뺊0Li3+lvY8@1@3B<~1t}) Kwrm`R.f7^]mǬac 0mZR⯾Grҝg 7Ǜ ZHe$}U+5qs_)Di#Gm$ڱa+v8=هO ձHHlӌ$(,_u:*a D&0DTADv0;#w0>ď©BUEn!D"BN2~&2v JH,wb(!F13[1HQ01u_|I3Y.{H6<:[0 Nq $RG]` P#G/nCzUap$TjKaF9a0(ŏuŬ%ծcT^m:4,bl{`kQ.->M4h(H H,?weZTWvv_~@CCzG|gd\)94i^Y sIGf]χǎ^>#"]~~da&M[b(`1EQ-Z A w~[)wz.[}[o*åXeXUCJSG' FR 0^G6h]IOS?Ф';U%qjG0nm&6mQR)PZk~cpymFKA]6\KK6ְbY$,Μ;02fhd5l1]* '#F߿~|SҶvdyH\+Q_c_>G%~Rs3S&M*.hQ@L {Ld2ʀFDpZ?H&Kt5wvIbPD! ρnч;>tϋom0QK n;^|6%T(יU4nDIه2'N} ֧*nG Zz_형ķ%WZ2@rd}L.vʃv P !5zXl7wh'R.6/Z /hW=vSʭyύL y 3!{t+Nҫ0CF8r@ w e5Қ7h.@6>̎qL6Pp%; g˔p3U$aAD|dJ2Zx⭑:9; QѦ=_*Εʚqz0kU^'.H G H4 OE~ "Ԑa~pz8|7-⟇ o\duGw:呡&|_´Y a HO }< :UӢ p1RzS#NXk)ֿYYd׸ECL7ÌpGSN~;ptR+ժVv,nr˺e`P:hܳnii{1H30 {́)+FP}8*І!ׇF5Nƒuq-Un<hTnBXuqlF.e 1_ij}etP`,)3Db6a3f$ {χ.~}X(]aƢDZý^7Η.% RA05DD sQU}δY%e;mXOQlCKU2"N|vʗ=f  [֜7\p—/~cUа ꂤ#֖aQURNAۗb(-ֺpqXe!`,uJE}Jo!(3ieV$FI@try[nX) }G釣|Jtp[Y)om3#]dg;p!P|gy$crl&58Z0}獵~;Vn^YY%%Qh&xWyA;&iҋz3׵5h0z_L/yhc P" 'p(M3I8" \3:L-0 yڊ|{;zI<-V啇)ߜ{8m(ovXҐ6(yJT @A<)pŐP(@{>.A:dݫʴVtv㟂2?Ut6lCХ F۱akOިSm8T asfѪMͦRIdֈ 0oUk4'%FDbQ.L2dC!r$y*۬L v "0`&!M֊d,aw>qo'me Cݾ'Ҹ~T`۾8 ? 0VU00HA]duiq^-,4Zeœ╵kaV"P0[;{;uڟ[[-)L6Q%g~Ǖ~vV.\CmV|Ct>G]ຆQZ| 3-eh၆,kBߡqiҺ N ߊ@g8oˈ[H⊫x !tΡ7KB~oae֯K|y#XhFndlk7hH+u!5kh1ZsZ]V]^F Jn 噾o@ j#feI+|ֵhFuXmUm`2o#2FbҪ yycL)EFG-[L#Tb Ҧ&UX0fC + (m*afL\*chV]-L/%(bʨd[b cEQUQbS1ɩf\K *ҷ4EXiV"hp JPpb DMH{& ޯ̹ÍjG256*^gj\1)J\_[lviG?Bn/0 R N"S(%g<j(\roY:@ڻ&2+[ [c]ks,3Zfz1Ĩ1FY RQKf2p)DK"[A)2VU"!D\ki1") XҘR(Q(*.SՂTPb"dmAKyw#}+k0!"DE  iBwꃿ4],gOj'ƹ$9 GΩZ03'W -ye~$$_V#(BP0V$K7[5!yB)Ghf6X<_cT֑o$Vfɷ\sbBD\e+?n G'#'c) 8w{ To.L hEQa{q]su]nrX):,,îťQ./ܹ ݺ{W P/:vz#찖'C&*4loj'UDI,b;v˫YtʄƠ`FϊTPo2HQ_n_C1WE]н=5˷H5SM[;]*> 9'D/=UN߀q5Lc(#PCD$5j 죂QAFO&$I#2*X'swtkzA~?6XOoVٴ&aEs3aHk*bdݡe^NIjjk΋LX@f(]WtU qn)8Ȋ H@PHUdKyl=]fDd #" Frphcwd;XɁuFQ} 86_ &!5zukn.O{,NZᖭŨ<С MF[ 0G? sK/SCa_Mp46񔫫<NHS|L['Oi/ bEZY?[M\Rgd5!pYߥO:lơ8٥VQzm<jU60YJ) eIF~1ަIr~|uUp:نk/-fk. *Nӵ/䱣nPKs-VfDߧv$ɣ35xh Xe N) [m^܋KxuTHqJ!Rz@ImEpBHYūR頴ߦ[f,iarq\:9\! '~8D20v458ۊ?j@h d-Yv,Rӏ?v)`oEUZ-o̸jff1A򱏡}ug:!PAy:+ydzqa~$nӬ-ct֯T5WGD Cu (y58~ZA%,^~yb%Wy̥Ծ.ڧӝ>ƜZ4ʼn`Pye@&($ 1 TN48 ےd04tZk/Glw.a!=b:"ͱ' un̫f0@^+ |Br7v]nMaɢgɗ4n/+fCZs:l s! &t.;ql/i &V|P {2ܤu,b"2mRD g/g_Cr] Чo^*ǻT׷&|Lw9I2Lq5ܗ-{ RWRպ;$vdd"8eQīw18 n6R,AͳU 0J_G⦬wӷ9ٍz vS! \hC` !pF|KAO(nPcɿAVΏ9o)jC-V>'3c;(Uq2C/<`(/sMAc()3_pv~sF'@sE4$J͵BE=@Z.X֩f%RH)nԤ^hAEuYsg?j#aX12^c(5bVv*%s]Øpp4<>#8*AJI6^=^"ĠkJIb%bf$E0$K~DHgžhbF;b4+KZ=j>.[3"tҾY7ViT |"JT˿~( j%8*ə;iǻ[q4Y \t"m4?+q~-,lـS.2RJ@GK#h[je|)cO(+[.5|W$c" >&A(u 3OVdAH-ȩD.D w.[֤2<77V m$ })Ch$; M[r;ټxħ%EJv1FA-:eRp3Rw O9Xa)ENo``W7`M*SzQVZfd.efMl9uvOi{)"!,"I Ju^Ui[WF(.X'EߴcTG0\9%ڼԝB6τ $Zh;#B#S}m&~>8w![v&L&3AMfF ݻGy`V0GW ܳQ! \d(kD%4bڪLl5(fc10eCX|bA6Ň;,鲥 40@kVo 9YOQIvܾt ֒PҤxec1E/> "4uKUIBEPJAwwL@!tR7p(cl#X`[)߂Ulu&vk!@P,*oE7ss6(Ǐ7o\cVZ!4^-r`Y]'FvҘRX"*V̫\S18 ɣ4iĩ$-BKYrPtvY1][ơ]o߿Sޟ>@/|y*@jUqE  .4{~驁G`M*\`[Vu.-\j#nA~SwQ=;fHtJ\Jwbr|.srڂұCBxɆٵ3ձ:Ғ۞㱝&OgcpzȽaʋ6N32ŢlOnt7Dhl+??. #FxؼZ$F2f͏;SC&8*37k_B/WRڭ@4+:}J/oug @X,d(WVY w\IQ~(W),!zxe"Z"r=x? ]|q}E7'RTR2:;%tc{rptm;ؽIQUV] ,AP!l`5egZЩ ێcPRvv.R<[x`+Pv5c~gŃF.3[:̤\S"Ob;X@:IUOg~̛P>3*E3J1 @ cvq[A[QG+:?*$9s)J!I Qf/yR() hݶޜ'|lL! Q"~;U[]J֡a%e['ʻ|9(8W \=YU>> |%1^Db  4ljH׼VDb ,B޽b<:x9v}-ڋQ>;iZ%Hk-^l(Ioӑ7Hsg ,i̳0hUi)~|-6rK)}g\wv ZR p1 /$@AT01^D!E\ɡ(Vq[_T2eW̧JƜ4gs;0S28Bz g\ː;N4Cr'Y/5gGѤ cx6}^u}$\eLӲ݋r〷)@]o~(^PॊXϒ' @ɷ_N f_o:^Bpc0ʠ ccQƣQ xoY$z >zw>w/j>֢rCō{-DI=L埰ԋp X8S#Zpo jݦ0BlWw~zw1VU8Dy#no+a0hʉ.ȱl*TC{^Y֙$Tmlȧ4ة}7y=:?zFєHUPR")!Ǎ,aش A O\I'$Sqts빯;,Ζrt:Y gf(2WK?U#p zGCAɀ>۫Эr.+QETaȫ?oh8e776pUȃ& jnZރ]z|~'Kvd+6$_tJFx|kjҳzu115G$|Kg~fkҍ#ׅ{ 2Ǜ|L=B}R4;7c'CPZլ{6y~[N>o*m|yPo>G}݉hw'rjTvgpzdw+˕/ O1߶9˛ol#_tB@V|5[SBkVfw{G/,., ;s!$fCygtU|h6`5ƣV%)f.1Ы0y>e4%3{}:S-؂d1i]~,Ϋ6~2 r (A^1%|ҵo{W.NaG)* hP$TV֍r٤8x{w{FG^8J; Yrw*˥zv޼y&LUl3b!ɓ*Cf;w>Эnץ4Ƿϵ3_wG)0@sxk~)St+xTTRn։,q*[wWW5;fQ{ۀ CwRh?Ɇ4oZN Ehr7<,;\  IwSΨaM|ɩJpeQ6khS{&){08-k~L{g@pG.xDm[p|H;7o~/Co!C8[ro|$9PEg7&rE.W JDX?/)>G2O r W{̿݊c𪐞iU=ؾ6utӢ9[44u6 w9ef>Flkoɕ!/T!LOPv+fݎ28"KW'L4徫Z࿛V2>MGya\]m@S_ <|r"F/>W? ;ז^Evq dQJrbe) 2*ŁJvњq[n*b wtz*{@ _9xr"z/D,=P 4am [0|ǖɥju],ţke5a D@H@M) ̶"#QΗJƼըCC>Tqưj3mZ5 4vD"J[E ߲Px _iˡn[0t,"<b{J`mw\"$eYL QF2)ʺ AGyZVp9!EBhU.S'9"41?X1<;+z]8bd)gs*ə5 WӞ;j⦏7^]F…"j A bΎ\t~&u 5 ]Z,u3t1܈̚\ N'&Eճ#tYo_[v=7cCj/ ڭ/MG"^/#usvOX &D%+c UdTzoS wTmRR MyoQhyY/"J!4`jTGmYh~ޯCsz<+G+Rkׁk~Mp|Z<)h$3* ϭ$H $?Ztb.8:y$ҙyYAwٕK$Eb.6E~;oN1E6:/+H6*̥sж)HP2)B 4Z$.f\9cZ> YBgT>}&DX"8iE\U]I<6^wCsWf5Qw뿗ȹI[ Du\rƯ;ii֜_BpAb^Pf^[4wzov}vu# f? }̞WW* ۝.^BWʼnV) ;JS82k7voscb(BO;Os yCz fLө<Ƙ>6Oˮ]`$ EÎfLF*<_F4!N9*JVuDrzN:uZx ~7 4z L \Q9pݹo^z[1^-ɝ{"Ѯ3.^~^^j2{))dzi{AD #{Oeʂ(4 ( UjCj4e@ZRB)!E`p뗜$8L$~[VP$ oBYo^O97ki\N`sxn>QuY㺤f.=q݊rE,BLAQ$DASUD@R% P. p17JN<R&@ʩO  wx|m}N,flacCbz&|,6tv7EoS)miK]Lf r#%q xL%(Hu?yg#{~^uH9}, ,Yh;U$DpLWH;>D=vusg'UNd I"@=0" !tElg|Z9p~YYc7I\$KRr~flP @gA;'ZP91A j|G4_2 8d-wa{ko6ↄmR2{k qԸ1:Ia;:8]i:Wc̣oFj 5wΆ-J2q1Y[0Ѫe;"?Պ֕M(9̷\ӐyA '݉> GMюcV&'U YK|Hfc zǷHV,r`TlLMjgՉ!tmף'=>:ږ8ˎ}CM(|;Mi7]/ٖT'~LWEPU\xG?\1nw+`~] j- l넼UfeDD %E>Oj mFex~:)Zc5Gwcmu'ރ,y OtFEy9QBuZo9 bgGW?B9o~ǟ5sƿ^VgR*|^s3 pցhUl3=m'YOV+p05PU4&ٴ̡' W3u4'ͩ5Mn\ (cka7-{ƅ BQii?.rQ4cI6{Cu5^0ѧX{Η*cZk̅η9FWiDm+Te- XyR_kM G ȼVSz1Ys!֊5-2a\PY)R{ԯCj=l A_d_m恵_6u/*@C7Vy23ȃ} 0 85^3hěQFpC ߳lMtM =@`lirMx4(sRPof9cbFnmWg0G Mf76w.>73MPQw9ap̱9Y$nrp}j#I*IH(^3BH`axh5'sm~J }suRrpĪ?}(7b %^pq`K>~:-'u᧓sZ;;0g?o uB9b1@E I\/$*b[O&kj\EXu2fVs#\4glszlwHo ѠF(kZ5wV_:,}\kSP!݂eMa^UYvؔ`};6V%w]삷śe"|a7Ée#㗸mBHɘ#*u`">f,jr]+=!w͎iWy{w[+AY/ Pʦ͆=C`AS0 ؽ`Q4hDԐ3ZM:ͶIVpϑUBUjnp ]\: Ns>p&lwnizlﶧ$,q2Ijt;$L{d܀,N vdB԰!1iiCl}>w >(D`x|>?7 )$(:LL*HfM ERl|*EMXP8Nʏ{/'ӻխ"ߋKk)@!gcC{9J u6Y"cAEsg`؉ޥ rokzlqun͊9'sߝ>~pҋꮀk=WCա9qT"4-ԭQ=[iiMQ PN' aZv-s"'~қ{RI)do'ٝ6fu_Bb3ZW@rOO^6d%YnEzUy e`0F~&G̲#4jceH(l-s̿m!Xw0ǡX 8PA] o^2,D5v{/cK s ~.61PeӢjPw9]^fq4 NͥV^4­KgLyKmNVX֭v.B]%!ORRW"mF!Rx7F17T ci/\_~&dK4 S Pa=E-g[ӟ1mU۹G eq b˄8rZ"Z^j|#[=b\c@cQ2wtž16nO*J_*)f0'Y VV@8䰔պ~.kFӭӞnyݑE$P0%_lW'42H$P J28z szr7ݫum*mf5΄rV0l0AδéaCLloD0Tjk%2QQ@h:m3 /}K9$Ґd04o(dBzu6_ =Zl=p1Og@"৅Z;Ky3.EQzRj{_pxL?PYA,'+j:#;bo "?fDrq ̈́!FOU&2`1J&a<}hTWpڴX!ش)n0 ӹt}{L{1o37컕"UIB -J%^Qp69`ʔHo&+sQn]mgru{>/>Ƽ2~ p鮦7NM,;x|(rx5|ziՙGjYawgS0x9h1 5+1O`' E0àv.QPRTR9Jq{yu7`2;yc^gfVxFj?A_\.B͘"P01;֣91*E,3{r'X`<ޯx kN\ v&m=Ѥ#4]R`BF[7yjÛbxrg'_[# h> ~n[F7/S5^Fyȍx9ӠNw]9c3?sϷ +nIș&\%mDw- ϝsn=i )fXRBr AhqECm{a.Ac9 ݂Z׋"U(iT62a >?R^I,O4]vU* #'O"N4.` 5cƂmC?;׹jڲcAuXQfxs_^=Y/&kC.("n/'mSF5"łHDT|0 Ջ j @;F-- %dZLOѪ?ADfl O[a!d_>+͛B  _ݠaIo4@|iaX?6/ e2̼J7׶MBB}^`JXLu-,i:]<ҡ0/aX"bmQ1 T 8l?Djh9bK3eF9 olS8RZ!t|}wNӭ@Cٓ]_y/N'sڳCL,PA0lYieS~& A x0Ñ~~U3RBFY}*3ʲvO1 ¬RA,'5^bEy^ ,A ,= p!*# U*} @ƙgױyqq4H:wz[AO`bQ1`h:U2IN.F꾔6U8"[@Ft0u JȌ ʄIq1d@6F9h?l{ZИӤ2DF@` VgrDdRAgG^=Yqs>8,ݛS+ys ɨmOEapBNp(sB)(I S|ݽI"X-M9 K]Pf)D5ፂpZ*P1YbC:Yً@6y.dU^I J3߳K7r(PqȢ}cxڤVͫC1ٰa__Ìuhn]zr*5뵮PAdМeרOKD" ۥkNw9L !,d ͪ,@E*?ڿ3WgoZ^MT`$PAc#\g>p5}RdΛ)@сkg5yP 8k;M1?a(\#k7K7K61]uhMzUpwGvW_Y|.:a Ltpt Zt/vR9r_°(GAfûm^Oӱ~u((DRWrp9@3QXiM!kD-Ш@в">I#hv(,3K U#V:fq2Υ312Cop*&Zoc}AFL>u9TEo;UM0QҜ[R&Y(;BER (g~HfM>cMjƕ#m VQκ۝9uʢeYWz!=v;@0{G$u@Eh&`{+jT +y`" tXƌsmu^/Ѿyw!WȭhEXryxf#cb;`}g#dCD[?pWb[+s(F2ZCivj)rХ?Nx( wSjٙxD\ 6!B*9$O={TmZ-@[R6`zDO8GN8]^:Ͼه 9$'"toz[?mXDMTI@#%Q+p;@4ɐ1`(ke}ϑzlMPݩ6DmRlFVExѦ=RErq Jbdx Mk&hɫo .>խV\6wU\ [0֭< i/0FB%"C&(:0T,UYHgZYB X}UÜK߈S% (HIY.qpdr 13ŵ8Ǘ|i(+ҪmWlTEX\'NeŭR,}\ !pd=Dujp\E$f;rEW@;S"9+jAIjj&ڗL8 #>Q~E3y+j7m3*#NI#3VAZC@™^dt}XCLUH 7.:qDپ]ZJEj)DH7Eم@C.TtE"3[ȍ'Gd(FW1hQo"=e ,򞉱Sc{+*1J $AB:ql 7;lGZ-a.:^P92,XD#%2#֖, R<CYl5W(T;Fݗ$._q.ɜRplY4MP$ABHPEPA%r^)ARB^n`DB^,6b;G]9r\0FhPDT$pD ٷK74M墄9w#BZ7vsGf̝>uiH '{7YnE]bM.EwnKT{},#Óg=4X ]sXiJ1NqRNX -G$Uh)pI9A+]TcWœ oڞo+dHl@.b@c࿆B<[k"进" 4gX/j^TdJ4+޿Ųzu]j1ed`~u;9Pu<7>woHh4ң8WHʭ "vl괗%#z\KL3ŬSKy)!IGAtb-gi)92j\à F:"AQZgΦ,L<(ee6zT 7 Y.J_k.REz"p!ʅ11ՎH==Eŵw_;'6;JᜂI0P 6Ŷ㩎ߣv:',Ѱ8I&˙~WV";;9W yZWG;xuMeAPmc`ʹ@Ѷc l"n]}Iez,"i0ˎp4 *0TB &[ذr^x`J @ɀQn o 0Å4xҺ[6O@.[^0Z:@uc &%ӮJ SPrSK|ܪa%ckߦτtEra'ˮ۱`2;p]N6}mV5˃&zŒٯnhK=哸3_t _o*5GX3Pp)vl5!̎s' G`w ⛥pٳduVq6Jq1yԢ+*H27hu]tpgd߫ٯ/#qy7jod0ͮy]1FHt%Zxk!5S=*ZA-b%-30d\mDy}"SrZ!.b[y3v,Xi9ۦWJưPdP $.W%4V#\ 0 ]UG񒯳?ΚwSmERq3JN=pS7t6~i-\v: ˿ Ζо(pd7..lںtkًH_)f :!4YV| :ۆkA#o5a ,a]Ŕ`=xyi^.Gw GN!P>!_/TɥXZ4I9=_^{CU;e[p:voσv#<&2\s⬣Mi-SxK `8$xJFMhl!3RN-#uq*/\:["9! \O~#ie溿> $tuJm VCXPʲmFYXTGT_!ÄUᬔ"u/.0F6ӜNwॹρj55_kOʻT/ΫQ #.юZ{jaѲ Ժ:t[g?X6To:?vW/W›]3[нa|X4!:q *UgӇm)VL"%lY|A!۱|9^be#EC 3!*Tr C'^qr \ԡ.+)AGc}>X_(nzhH;30=jU0HP}M ;Gh]lj"j !w&k 7;'ɚ%kXi\y<[y]$ղzTNw.VٺK yu3tf~㲎^V+|\;rIB8ℑ !kmcz4]미$LWŲ؀i l=8kDUkQ{~JU `ŅǧK@8x!$jtkrG2mc/ڂ\SS̚!Zi5w,*QD۾ѦlmǮErs^ k$6Q/TyqQ vWsӟN)g,Xo)x&VS>^d/p L{><0arЪ,ʜ?w6{ZvϷ,E/W܈<95_.'G"y%?ѰV;ۭy# l޾I'#/Dž"mIz3Y:݈y}}s`O ZUZT'3v+1x^dDѬ)l8u{,GIGU3IAjac l(VBQ "'ME6 .D]A2bH"@Tk @ᒪ=}3ӅB;Z T4N/Q$mz|.:~XdF)JD*:>-\VCyUx( U蝪׿\O+7`wQ"^6@Hآ,S܋+јI*DagH;)h4 A 91H 4J!h]\Xt:/Egճ/J󇮳EkP¼djUnx2E[) `${;pԓ9Kl9{B[(*6zFhRaWZf񄃝9dw~/C7T!=6J;]<7osfJ;YAn2x]xRjdܔ,߶ńy=h sC~$хgIZ2)S'g \̮\55S9%ysY J0YUW[V4QA׬ eXf==Ѿ_Yaۜfnp[.)Asɼ&[*fb0!A0U|d˼n||)]2fHDtCSz{I[o08%,2\$Ѫ ,$Ve(Bb-j\e PH&ќk0vceьe),COtM덻'~]>YLz+4 #8,jVThkhnj&"*gOusɭu; Raѫ=>+ TTYrqz+a\2T&$yIL#vZo$Ȯd#ĉr y1b1_S:(F1ﺍaߋ{YÔz溭 k7;ydW^~ WpwN8[rI:e{ꎻYЖCi\{ Z"o {M\]{ly6 ](8nqoP'!ln``oO3薞eRyiV-h_=|=\*1<z x}WG|xS< 5$afMngsZng󤗳Kǻ4 M@IL`0Yji;>eZBPo THEƬ<ײ䯥Qf(2 +N%<- Wȭ̡=Ji %',ҡٷA3#xQ3؍&JJrmu˞yoJ I(]@c Wxk BR*qgϠc]+ްGF. myjs@n5^y)I!9o~Ǽy;2:Ee_y}!c oPt۳>Exx.uoA z0%TwЌ 0,qvO֬<bnE8lP>OxL7_ˡc_C!rİY&L_bQO^δǕ?WcǠ75ϩZ%VNNOgFk^ծ#2ȡMsܪft:9t9m,5g0Fޚ΍CvhyZ  s? 6MSN⽛|mwbsxSI4rP4ޓX)AdGaD;(,kv3 TA~gٮTl qvF{R%Ȕ``'`>cY#Ȇ4$t@?.__Mx(<vI6 [{Q]oN7YHn<9P8]踇zma @jEpRMp]H$Dcuo{2ad:hA\GN[[(f'XaQôޣ-bn،?yÛ^dVM@0aBp8zY' Kr%5AASܔqD_w%WhJ"1,̻2:x/'=ߝtho icJf6MTՅh fYپ9.&b;5^A<94][ĠpiK{=^tR^KnyO<~s}iBj V /.vtDvzj8qpb39/ !LU|Lz;2rClw=AٱF:QB i ֘ԋ@Lƿ{xdCVLVMPXL+EN{kFpz4e7It̗8ix%2zPd JUJ3X( |_O~/>'*yMdwĮX (lihhB%Oc==]w۸BlJ5k} c9/rtΒ&i:s_%.b(Af}Wνش$ H̻-WOVP;?^' P^>rq|_tݭu}=Nj)`\jc4{ӽyzK)EV>`U6!tjCoKU|hڭ_[ks) 2)$($!ZHF.#\o #٘3 |nf671LOőށ Z$cZ^x<c^EpzUVdF:iBY Z8"@" E(kR-]l'ZUF][^*s6/I:cF9u+=hʄ0Wc'ˣhQ`AB b%Z<  <;:N9S9Y{9Ĵ",F jwF kϱ}iT &2[U9-#v6:6lMe4=?ߓjsۊ@)ʃ,^rːrTN WP4{N[zJ'l:pP\k4kA^颪~BtI&aSxu#T͑b?+F < Q0%q ]0=-lX0"@9j@(b˙7=wlӌ,wF"򊣤 u벷ʛ:H 4m.P zR;cqJ`HDKK@lrZD2T Š dhZ^ JS{_Ç>l}M4!(hAlUQo WXL`$Ė`ITb R[g~@ej!5 0æIAW/;i߀׿n׶ףe7:+#  A@dԐڸ DR#yDRUרBh)\.a$ ? 8hT$]d7'uTFV3a\i ҈~mvvV E6X-!55132]v4כ;y{Ca,dһ% EEWfbQpnX%s5d0l!kBU[Z RQi(uyc|{gv32*R_LtH[c(QYLf21e1ֆkxjh(&8jJ1 ubƪ+3"3\C޵KSHKPP"JC p^nws 9!ٝV%DT`a>dCMga2-"myU0l2g`",YE6JÏq-&S0H'V5@a_ (jaI(~L2Ժ?C Pzw DDR*s&-~DrDx%>|M&U%GDn02p="@N r6$ZGR)GMtJ)@- +?oP\A$ >}~-y@I4/\:x˃Py'fڰ`UA6H5AvUA}Yn:CCiz~wi 2iyzT!6Fqx1d <c?O<>·VsG{F=h[ȩ2{)S-Z> )2c7Rtc # sE掜?4$ǜW-D͵ztYfu?΅|o[M4hbʥq{X~M\/ ޡ}Tڛ︬+9I(jCf,3חi!0`Ke\r i6$m(c8 n|Ǵ١|M0n5drN¹Ưy#JdpoܼBQ'?K+FxڭcǡpcQyҮ,؟Rk[hI7B<ŸZg6m k,+ܤ3WQ[cgO=RZ7u> +7^=/RȊTwh|= BdtS;z|zv'bkc=L?uPRƟj!+}Dy<,a+FʼnSzI<}(86M%QN,{6u\ρ?,Eޒ`׊3uo8a{ggo, d|çBTWi=JjH7!nPO˘RXPҡRZ3X8WlAwvd$Q&},b~:{ *DKnۏ*ũ}MRXFQB8LiQpdywzDM2<;<5}s\HߖcgFb v@)I+ܡy2E149>6;dGjYp0]Y hT"k *l@Tu~nתl|puIAݨ+έzv:b*X-xY^,R)Cp&U8Xe}K\yAvGq Ƞ%D:m,m>\k$'1D/۶zŪ/E\i}r2t:7= 1gʌM?sN#2f]h"߅eX3rwgAxgΩBv׋?Le}ܢj@רfɽ ҳ'Ho8p}@X7zv4<腰0-5&@9 1u=A`yU^iXl0ͅy3Yi\H(&Gh!S *ْ6S)Pa#XMvL~HSR%HaXQE vu&: -oq_9O|??~_5&e?q+AH:p+4O+Fb=?U՜Y i;гSڗJUcL4kIM=TYb!6aTӏo~Y~h~?Y*罅盳i6OH;⿬__G3YOT{V˄/<̣iP ?4 ~rsҙN߄;{3ǧ(kN:ey=a7~pOUm.ݔHD9`AWQQ |գwB)k^u'<"#JcRE(Srfg bVݬ4[[.bI  ~h$ATL $O]گf*F2b JaaQJPZREA[U*()7ztahѣ_z2('wja6̐st6uy=^?ŐanXDEXW vc,8U>.>SiE#T73+[WK(k imHxcNq?$;LyugsAS} #Zue 9s^:>>.za"O.M`[l!IgII?S v7 xp5 y *`R0J=e.k6(Æ:dR "ŋ"$|;u@bEBR)%}~!XnI#&̿O Rdi p$)PFtǓi硣0f< cXS<3(HQEa Ϳ&UFz~[_?·)HYD>5up7:/{wr;'(+Ǒy/uJQpAfڑPfNE3@3^hi88n*-?\5NNyMSb-ri1u;،#v~GDaRʥ -WCPVt ˆmB:FKS2t捬9Q8Y%ʩkܺD9UA [f7"7$GgQC'*E~|=c%<ݼzQg.mлEU@ _x1/=ot9uc(d@a)_9Wr¾ X9 ^b3XId_!$'V;({dzZ{mGjI$lÙczu^;t B0BPw^yAq!鹕Udy7 lԓr.~ pe"fi1ek  AB}bo'dg pB(| @PkXlE;^~|N!j`z*gggN|ꪀ bnnJZGvA_:Qͣ-X!Yut we i`fhFC-Ffl“6|7&F齑MhרHڠ$jq@(oBৗjLd(  kPM:] sgFlY{S4.,Zפ{IVzѥaO12L ~ՕCÅ,Ps2= \`Dq% Hxo(myH:HJ)j*>Aj$&E4wXX=-m =slaqSJ3bB1>Nv%LQZb,Xv0A%gUI@ t7BL0y|{Tg xnbPQj<8A6>ks7^h~pk +cks3ME3` NyЙP 2CSm'6|88?DqK`[OF~' i2E 0'ֶVNӫTqJ8' @rG(PxbcAeBSl8O&A3aFPU{.ey3vTpT}yq σN[V"aR Y vx=˗fwkm593"bbm}s7{ VNcDgoN\ۃJ.]!HD$H\ gzD hA,~(wPC(OnIЁ`FӜcϖTcA(I/wd'0DQ6L8`-|)} _?t#T}Kc yX)X塀ÏٷeĔ u21ۖ4kkEZ75EѩT< `d{pX{?$bmPIdy]'g+F7cI(A?bn.g;(61BTnf0=9@>.w}>ѩ(= u6l"A|U֔N32" unr s';MH$@"?X9GXT;y$}_l~Ȍo~ٴwqdux6eR2nBqƒt!sPѝe @n@7bEID2mnq:Aƙ&)ٍrs9+G%,~yAB*>  GN?: (2P=aJj*|4lU8'.@>5ɔ {pSϥ'(@ؽI91@0 H缸/C.xأD Ͳ74_i* S÷o?P{k~vP( O:"п}'f){O*?<j/͝XfM,5lBmu~"$&t t3ۧW%{z+e;̞,; ᨗtXT#kٖ1?fzP)滔Ɉw. 7ؘsTL {BA JXq6(KRu"5lKS1I58$AiI^Z~Ĵ8vƫְWO;oѲ3~rӵFȽ@yMZLOA׫ŝOs57:?`\Ã`ɋ"v9;woE^'b;r.?DhʘڽA$GL[kZ9h?IVkUa(;@L~^K;&@ͿF[nӏ w^ƿ5c&jh]RY?կ7n}jﯾ} .ԫvqŻ=}}=Үovϣ﷭}GvtE%JPkM >3y.ԧP{2֯Yw-GDͪ'm(emm`qNY|緼C}w7Nrnzvc}9}+EF>C}o{tUާUK7P՟sk-Y{|vks)iElۛ7lo} ={0m+s|s`/;bx"}o>y>jPl[]-mf,{;v=ݨ˼9u;6sOާnZ>("^1gzM>oz4;]۷}xy{*}|w}|i@0` 40M44& hɩFS$L 3M jO 2Hh&& &OIy'<*~ҧ<(Izz)oS# lS=2<HDD MiLMLTMMjM?*i=ɨf=O)S!zP4?TGI" BiLI馦d{SzdOTOzM#&4z=#?TP4 =@=@2=@h4hJ4@*~jzFSiOhLM3CEM*zjl*~FOjzjOM4?T 4S=OL~7z⧵=)"@F &єM?OE='oI`Sځ4di~MTm!L3Hɦ =mOSFC h4"K{!]ǰt "FPҖe6?̎:^Z󖺱5 Qfh,M4TbF-53f$E)j?  !:GHOT?S+ᐉ'=s ^ Qd@k2!({{Z_IvOxǍ<̋*>xz  ZG<$h0'-e !I?/[D ~(B?0)@1$@Bz_eւgt=&qBԚX]` 'f 2&2aZ4|o H<8% GF@N&"<׽g Vq%^  BH4T&aNwX9{Xy3W0ss@̙8;E>GL-kϚM OH(v-l(=A6:* +KEY)TUelɃD1^֫s[9!hy5)Q4$ #* oy?b2*6F{ #JU 7{Zdc b\c1mbzĮ4413 a2 c2/+W?` BԈ y6۱.N3gǾIA: 4 s撟a9~npQ:7oƪE3ܾ9Yۏ}0Ub?vID"Ni)X䁮wP,$ lrЪށm0u+e\ Ell"&O-~yp[DaFO J 7|~21DA ]Ȭr&ʳn #*ݭl'Zͷ+V[i?x% zEFÎ i} rRmD\^ڝ[&UK r|Rͬ)R;m P% ){wcЍ"hcTM41Urٛa~N;I(.G2! Ơ+@HT&./|$,#o9zJk6"*+?{׹EywgjږmE4TUkbxV8ڸAϺ~Aµm1j26MmnF|]{F-=A&LX`@% kTo2(xf$6jwr(&s!O& th쿓ͼp1gA\fͫz9Oﴲ*Cr5n? 4⫥9ᘃ.1G9.qAQ/Ĉ'w9ICJ%-ƣֲ ٶi_,8O,poe} b67SE, )t" m.sCnM<V$QLPv3xjن1FcBnvꊶqqVpS JoR8%"kPtK cTBe4utm.: bm-ՁK`EWQAא }-:H29+W|e`KnjҖ$L9Hwx_)rQDDG(T"8k??xy7 p#6a@/*׿<(&L<|;AI}m6b >Wˇ%0ج!T#ʬP䏝!{HB[n5⧙D/0Haax)ĝ`]\+LZwDU$ksSƱF{g\ AQ#S$F"tt$7|cWgԀ$\>]{BXvxh@Le+ձ 3-%V5LEy++N6 Tm&L WVG͙DyR&gPbi " ^5b0""]$FdB:"$nS`4UMm(v}NxmߥvzVfBy5tٚhJ r>BĎnB*BdM4c >gWMf+fpOvv%p;TMIa(Zʨ (.a%+]8>JR8dǓ|nY/>9XXB=3'G7w$p]VN B^z>v~կ9ĤR9)-1llqQ%^ S} 0(ΗXpMp mYc8gCi>#a9PJ+[: Y&Ld V6%±8mB.9[/ %^B$@x];ExYA! \V@Tٕr9lx# 5xZIE:\S:-9j3,Z=Ĉ}m{C0v5Gq@kQΙ--k2_@=\} -ILUv]~?"n ETb[(!’yDA( A5ߪ{Z!V J*L%YQuruoyn_#Uƃy>w.2y.@#PIKq^_h~9G!;7$k#i|& M"ڇp=\9{X;7}F8Ezl)a7[`+7E5S ߿3|)P @$8!*WSQo˗,ov^^n|F 6y2_÷C/(f( 2'ֈho3x4VDz$ v]v۠#e@!45xsD02՚fE;GaeUbqdAAE'͏)۸2yayC9`#Rp4n`,튆_ :5sK?ːԐcv2|=<`/X3Wϱ<%6TDۙww8q@yhDkSͤc]Lr_(|6gɓCJ]y s8s;a=+6: ۾gfM|wY 4-V,Y7H P):O [#x.wҚtrYm[VlkYUhKwMmƆdhS(HZJ1R~2 .-$ KUtĆ?a7!R`&:I,N=2BSwqWw2:Rޢu-dwYm9ϲci$~޶A?[|`x1@B qpuf??vmɋܙ[4m?Ykxm2'C?TmW FE^$jH׉!qil5!F\G<:By۔F ^Ƌsw}_}Rp;0G.i]1uu1Vb#(WWЧpzRe7&4 lLfP\xuTQ1*t]k;[urnuEmqm2uU.ڶ]a R\Rx\ vǼ6c9N.QR%FW@yҠ+b:cK&@qxa7/Gp'|v:4bI ;HH})ޛ8!y7Rp-}PdҀ=y!WUT(=Vt&,K>Ea`W8+ *fnO)^AF2)J98 !^9`zA|<=~6;N- $la\n3A&m?=WռV"h@!7#%7.eEWM}f}nf>YD |~aKh}[2hP(H9೸{|[V3@xC_uB1ƣ5 qۭ\d\W//Gў'12hAJ ke@TVx j7V_3+-@zfC/2 RXq&'U>l놀?I"XƉQ*: p98gߣ8 Sn.W;Ȼ~)n h[ْɹn :`u3 uPpwV(1H"Tt E>h^!XIٵ5Sp#vb r'}oH$*H!-?tXSݬd@ mvG"67`ΤfD VIHxʙ!*HA 1E}~/׿fw{ϴ37c.G<)LmHgR.TU9#Sq0G Ru͖((=ZA^ղ s1ӦKzXk8㵩*\6oSyuZQQ!1e.0 $G|'UW5@ jK^_KM oN\F rutxר@vP ԼI8DDΝR]K/@0z WGda*AmB1U;+A1$.c=i!HPy{ud(d\ ')S8>\/|;xN!5ͯ<J|R"A;549'e sqpw6Qa>9;+|D׿_6;B\P-J}Սl _wtsgC(ΕSz=Ԥ#1Xlu}O7y5-4hio2\?<#(qDLDYuR㤷nay A 0Ȗ aqPq@ F,5(EqRdՔ p2s: { FXs4?fϮHet{C VTs@zz=XMCC{͋= BJ&P;>L`JRݙю<&*BBQ>zoG/jyo8=k~ P+Ȣ`~i FNbѱG[ Ƭ/4XJZcA֏٨`rnWAn󅘬3ʨdlCҸLEYf[/,X)WWؤws`s}-MRXH$Z(X93Av}ڴw%#e T2;"T&d+$1P]m&OQB;O23qӖ1 #>|N'cEl N|,e׵Ӽ(,^s7mC?ѓ}6AsDBeF[dݘ*n V9o\vQT׬M?oy{d~T'0f:k7 Ǔ#3&sefvl$($0},;BHk`RTu(PT{رDI$A@ʇ}zXΊӨKcF;շ5ȩC^F 55 H$ ʝ*?+W`l| @0w07vtC4Ϙxp{|R$1d @pUj YcAG>߱'C owc*ٚgߝʄߠ C[u{ YJ\9kE43 |_.0.CqZeN#N)C\ਿLT r(Js `8љHODqM.5I/1.N@@DH8`h(mσ7Q|XE$qRi1QM-@"Qtg *Y>FTs6KDԬ9w(5B;N3#l}0(%,FY"'}d3L-@t"cEv.2h)G/}=kGAvawLNb)|][8怚V*䞧ZG^:%4m8"QJ}&!Zn+/]5)= m.Q+v38> 7F&GKDx30r! 9cXjnnG}1b 'voQ؏Fjux{RI'g' tl%rh`5݆揤_hӨGU'OKgo̻;eU *^=}h{]|/P̼)4"X4E(+8}HǏ}NP[oz AD Sdze& P t9V-%Ie&"']Z%X&_MQ#"&8X4L5Ǵ1,܀͆Fw;05ϏAz}c#X 3B'00{E  5FC 1x g4[]rK+:\[p\M2#?sf<7iV wRYfv)PTK>>XùLE@ zOjΐ')'tXI+'IB ;j^a:P ;TI" 3X̯+_ځmEA8K6 20P)])ߝV y5ʬ߃γ׌Ax֗75z UН{ b$L m[~yO C628o#gO؆9K^,U@aM,JÔC9L#"ڗolR =wY}{^}f]ihh1}{*AV*vl?P z \_sy>CK}AB$zwywcC#O12*aUE!=aP*^s΄KnBŁ~8uŀ4S΢7OFM$t+DMH$Ҷ<5^uԲfڶ@$LIŊڿ/H & |,}z50"e3cB=-dɿKbRATUU CeJ:>GK_)lK E@H{*=Jhl۟X3|,$28 H7SQ,^w'Ne Ly.!9O;̰\ m,*oDxׁEE $4 Ecr %RA_:P.YgM(I`yӠR{"Oky1<`lOxon@G'Oa"Ndz$H,=\L07 %Ҹ$ 4@x=ǧ;R1'e f529c6i`b"KwNczmX$Wm$\N$U^Ux@% BPPPc^< n%2'=:zg|NNj I5 7b6\~QҠDCZm#7:9TT_mo+ĭx/{}% 05ri% L%, !JqͿbgg4ii5Zvݘ69PFv_y߅o5s#:T ~&h3y0EM~Sq%n-_gw}f 2dyw<Y~>}~;bbFK"vWє4@tA¨CH2j/wzp#) .,)akV R1Ԉ5K [fS`l p dCstxCiZ~K@6lCsvkNЂ0>^;:8SE\TygJx6A&)Ӷķ}>c`ɓxeFlz6 p 6 #! $"‹V:sBxqfi'I1Xh~ݺtAbv^;7#HXC$rd{ԃn%,Od1g{Zn[Nmk>d}kRtĚS1́~X&nroɬN~-yǝ80d M1+H$ JHٷ%'բAR( H/N}SLB$nA"ymRkZ{!·'υcywNt{|Ubr Z7P|>ilALʠ^!)b1SPOQZhg懧Oܖl`Ż"H'30Jpe$F3JJ@bW\Cȯt`MijtV'᷌ Kizb5EL~֔! B#{E)\9,mzL|bA$HDmc62H ȇVmoVc<~"JtPwփ:xel#<67{uRx}KE|0)+qKM^\]@v˰UE@a5pABktu~u@܋" ]} !-Rݻ(f-TVhCoHE 32B|~`".mmFbX S\6z쐛U0A$ h /$"6̽對zwvu]k(&Q̣M,#Rb.M"ni)LQQDo]‹A^2ktt]caccCla"HxEHa `v=}Jآضwע"%"# ɐ/~nl*ڊ~%sBAk,aߨ #_HH( BKƎ Q0:[u2B3GC7V@Wce`*ckLU|o3auT{t}a4TbD)z~c#a+bA $YA#SFU{T8xXN42F䣄e쿌okp5,$9H&SI :&Qq:rTjȮm~/=_n~/^4FM$BHI^ۻW}/o}M{ ، ok;_ Is9h {IB $!$_;d#o|X9Bθ\A +EF;{2fPP#sfNUX;^CrT7Ne(6a #Cr A   ld0ض8 q*BFrps.8"-ng^gwcZH(}p}#ubK6L$!}2s̛ ;Zs !Ś+U٬75W-n>.j@0֒LK,2(DDΠTN摶6H0@'E:pDLH(: ˃e-eD\Q/Lkvp]WTG}z%1hm1>} Sj)!5gŧlkL5Ko! A(Qu"_tFHy>J :o=% €REBJ 0H9YT*TSaH $E8_@`%nEwpFT{4fϞmO8<I=[$ o-=%6Oyn()FLu8,++*c$ G{)Pׂg]ڇ!ofϯ3^Zk;,cKJt-J^:,yYyѦ eQSqhj@RjC+f&*!xzhѽ)2 Bse%kp$GrhߺAX6m[3Pbfuys11E@dpph3Qm H t/?: )CA" |njPf1;Rl]8C,v9igqO (uS]x27=`fE&F.~e5۶dr=5po]roQn[E6Wr.ʺW+Ⱥ[ݕ 5n7@[A Lo@$oEQˆem."M< 71C> 'PYEdD 0Ej a 2(.E E;!€P9AE9@D E_& EB;DCvӹv_aT1ATETEUGܬ\KJ܂@C*".q(TQzx(8QQSq%u+}DA,G]C/FD~ ESSA),EAP"FtE^g`MS*?,@Qv#"b:倊PhuV>R"&݊عDA;&$EmGgmxcۼ^*ccUYD¶:H93b&E=U 1DљlA7,_{"; }}( L"~D0j^kYxiJaH|;MI0Z<9:3:,S/^fN9-x o><>N8f @Asl41QXĖUD$@D TEAHALDL1$֭ ؖIAEC-P#Ȉ"`"2֢6h"(h)K3ILja RR2f% &(jd$!ZL҄F`LdSh)&ilI-4PV,ؒZTdͤJIc 3 H JLFBĴ԰6E LlT-0YM1 "fŘdDQ&bD_#H*䂆$uyi 4![VWrZj栠<L  MUUkUJA"6"DdP2PJ$$IF)0H1&h)Dآ ,bd` {<+mVVDjB[kV4EBheh hX1#V6խk2F1ilY #()Y& EE2fbI $ #)dMLɚ& &Y*cIiY 0Bc !I6 35 I%YidY Za$efYbDTf%3&YJA3M%,bM R)&T2CDb(YAH0!3lɰbh-")% 3%bB4P PI0M&͕2R2H& d3FfiD(ajTlTD&ͣ*Mhͦ[4b¥1fbJLȚlm2I 0ЊXJm4A!&PIVVoZ(I)JB4lDX" 0ڹ[j]s[k5_U$ ɢ Dhf6Β7Zcs?uwcZIU}UoX6ݖt^ugpx;xz@66bѭڪռW$ / S^&x1\VU ,ȱ""3EeCDѡ<: $ÛW^{q&$U{I)9Zߦ^ݛwC$ H2…Qb  3Bb,dmXhbђQQH4lƍh(M)6H6+ƋFQ1Ql[FсŶ"Zb,Z*lF4RRbشbmEAZ66+EAkmDƣ%ARAZ*EcbQV+0Z6j߅EB"U_p؋{,N,F٦[j097~6;j*=Xhug-g\qT!Q ylјoDO%3$FFi4P|h ]"ܻ>T{xc"!Vz ()$Ax^=49 &(oF* *X@ %E@qU6BDL̍ekmŶoG8*-(F3j@T@"/* H?wS,@o3T  #jjոQm[55 *]Sk~\#h7a h+YmZUmwi[kAF@ K@؀ !؂B" 5!xmQQXɶV[[[cZmj*ڒjMmVkEֲUU]nwŵ )##PIJ [Hՙuۋ'cci/TмfLp1_Nki:|ęxz &2bY͐͘yک麑k`D $:dƶ/H㰋Ƙ7Dl(8 _i Ɔ&j =qW+RUq~6sVtp<1 k*@F7~zy'Gʎ05m"CR{I6r@!Do=f'iNlNfv8XѳCIMi#ؽR~=뻼/͎=PIDɏ%SuU-\PEQ]@bnuӹK ȚMp(ImCt†DRR61gF VlND m$Fw}}{HK^.prPLQ^-6 w4AMPFAt9MkA(|`5Y $HE' ] ɪپDlY8b\yݳf%1ŽMJ|9d-^g-hx$*p܏wKjPDu9yڻo&TA7s͌(=\|.bg62:mPH֠) Ty`iuÑʠPP H 5@! AξI]cIBʾgN)+,(QfR!(ZsZ+{yw.|nEH5jI_~goX];!WDl'RVC[ uh-Mb ]gW]Q)*(J_Vt(?, qn~}OYv%#Gif ٴ{\)zBա+8o˽Kmߚdj9Ū6EdxĵPJ4:4cz#`ՖX/}28:[Կ_͚lfffpm1i18ȆgE˔GY)8+Əl +c騀|9A 'b5%0!;u}vI>>ws"\vZ> TWC| /h"2NU0+t,ݯA{^ Mlc!ݲ!=YP2-l Kn6 A"Uui[._>}k46y!+t(;5{ƘvuzwT5Y \7-M )}U Eo%ACxl_A.a_ĥl6bBwzxA7)w͇9-\߿ͣTODɾOһ&ӨB{HXd\LQL"H"PEx1T.C'pP A?u;*0W,1l{=ɥdd=\Ln5.K%t}ҿ݈1it9JQѰgdˌU8Fx>͚4aE'\-DLf6^vG?/o;;@=dPb٦t Yfx|),H<-=xׁZlSOˬ Z؞zקtgPr5L! La(Yx} +ݓ=_+d939gQL͗wOMQ lfYnݚ#:_Umɮg7 /u1?dg(_U5&YKP-ajI$$ IVd[3T*ShH. &ʁ4PH SUçE @AghirzNV0?,^lndJ +Lg 3s`XI?NM@3JM ﯩv!p=ҵaǙSDIJԬP-`|: ڕ{S -lz;[>\no҈A~Z Gio,)|6hRI%A =a$Z;Uk8~)ybc^M]4v7jۖI oPKR`$xQdEBV"-cyܺsno.N +IwEF bH]Ӭ`ϵUXaӯS#7÷(Q] B TRD$!@߫HQM,Nb]ͫ#X'uq޸A>&w-(QPʊoUoG׫zE- +z;>~%DwA0c>@v~)Z }0Z3/{C ;wN~ (4S^۸XhHHꡚ?#!{η;0@(\aGD>T?&c'fJ@)"M%9 ޮ{ՀAJ drk.E^l'Fjmz^U##h1}."hN[:)AcBJmGwmDbWX/ʷ9g;ijX?ߺ3[4h_*RYY- GRidrmme7&:}J장6^8 Rwj]@\HD"OxϏ;Z޺X(9.>4DCҠn{"9<*2`2 CRBA<?,{N#xQ OI\T4Ȯ=6/ r/H#\])V / +`m>I*"HochOoAJT6x H}J=`)AQ.@82! `A/`5e]_,D龏}n^o?.e)CbqD@Ş,GA ;=u&#l1,/^ODajߋ/umݠ)tE %~fÝAX MiD'@8MG1An-3kRXXA7eCMP4"'Z1Eh~ ^Q5 @vOm(4 >5/==k[ 08v4XfL67[KY59Ђ_!tmy>׊|}"R\X7r H;(;XhOy}jH>OQA@RXQs?f?%a9Srɳ7S8bȩWR{W=s=xwY s?~6%TGQe1cRq벼Wǵ=5u(?VRޓʏ~uqA7@b#} Gzjr 9T<1kIt5>,O':}\?383˚+k<:W~'vZ0/kxX򾝻_CtN ÍLУGF^.dMQG""/倻܊ "'-_S7B|yV@`g0qj8 T[WZ\$Dnf^e@}zꃹ(EH!~E(FÌ_(zx؄>Ab!CW p~7~^/3icګ{(#M \Sص6K"A*1#Va0 { _fP'y=HjѶu#6C-PE![aݣQf* 2ɀg;i^=DP!9\h<$Tr""D7%ת o,##RL&)ɒP>Nqey77{LjW2;ױc"%l`}>Oʁ$ 9tFe05 k{Z'|7!x%^/f[ߑbhʜ˦<6:N ³,8p"he+O0w2 r^AU0j}i8O:_櫃w5-2]4CB D~u ?T pf'|1$Q Ĉ`Z@sG];?g AEҠhq1W~n?zPL~&)O)]1[$AF ]u_W^HpgvF juYX)h:a"pQEĂhk͋u_UfE/Cذh ex2~_%)<}Ϲ+*tS!),$' CbG[+hli^Dk"ҳ&U42LPclV]e?qo0{gmpiOqn֡E{z<.{\ 7YxVWJW?RM&ٸ_M9חȭE{7 rFu']K___ {qq_k$DBt;}C#~g:ݥd \f+"wP;~7G8!%m}F5]l:oŘN٪6Wq ^ˮI5BG_|)@ѠsvaG~堒)( I,GA({%"`UM3PT[;\ٚkHV!|-~ z,[SXI` wf~lY2ߎEnǛ3hW ZY>l/.26 ?Tkp9}G963]Es۫J9oݼZpn6 f(Er|7sPԭB&.L=B^Y'DDb1%Vĩ i}z.H,+Bf2ՑݗTRmmM+"*t"K!C*+Yi;h#B!kR z rQKudWZ$zmO;Y{Q, 30H %@ψ;!.H- APH~8Xe  )_F0WJ"^ @1q]E[krF%* y8 "w8?`GM# t?%V ]J/z9 I9+t%lo{^>qfP1C*T|63ỷaV-j6S>*feWjWYcK E kt5ŵW(0}yh1Ԧ Z jÊ's8PC|H9ULkzc%I1Q@{yGxzјHG5\k\4(ͱ4l9s\>5֑T* ,j;-1.꿙j^jLbI<5xKJxlEh05] κ9u"ɍW.TT2262 SVIG,&W!s΄W\6DSQA8ƙJ22B'# ܄m6$7\7xUɣhY5E#6[ɗ먩9ݩe6i(ț*2$*ҠK-B`m f:pۍYYhNM8\Q6*QĊLlIUN86n;Kkq6M\\LP(0Jdj4ee%5E WNޓmt۽n\Ŧ[S顰cڄ[J"ZQUqDQPD_Kې(+DzhN/ٻSSLaueIW'^~z>/狗LAɔ0 6ЂQ*4Qi4Vߨc)aC &9+յ[/)OV>t(72=]{~=B`^Zt2=oʹ6 X2A-W 1iՄDMϺ_PP&|N4Oy.=wI3P[!jkUAwr &1AJ}ID|pzϏ|*Rbar UCA6-0,0Z\ oKR=]%}H _@8=+}fң]:y++"GxIçĸڹ<XbaЇ|?Pu `DNqXw JSD܇#xNM{cCV4'Cw|nx6xյV1NWtɗ2k$???<Yd  S鈯A9sxxRYD$M.uem#j>ߺ쪻RX.nHӎ)#!l%i` { |}<!]!> ,a#fƳ)[!.d⧘\/^9I➽nm}1@$TծbDWJ "σC'.A0PQ+Q7XE *ũxVA! /kTIl YiUC* f}{xMsZvubV6,_oڪ/Nz4 )]fn+sFӲ#I!  cnA m2H8.ǁ xY<Vm9CT5Ag孻:;y%딿sCsgݞu -ܠ"ZZ&_t1a_-Ût7veǬ#Lr44mGһe\p*( <9cswtYd,vJMA+*qc,a=iA1]pYq+/{z5Ɯ)j;=Zˌ„R $CQ cQ(Ҡ吃r ndjYhli@A>eƖ.c_.;~u=xڿ'qI$b_ )$#Z 4@B6!ZIhPhQS͠ni89  a%nő(pl+zP/|.@l \ĵEBIm1\j1iy͖v|$̵) jª([ .}L5Vᚕׯ[T ꇝ^xk] QP֦h2Щ)*YB+f-.ŪARص˜g "~.ՌbQRTr/#.J,UQqx#(0 @EX~{*>_IbiaA>,ƘV,TAQE Vn(ݢ" 'Q9 Mmh\CCS0$B>&ա=4S@(5eo߁nJ+|駳gCHX1)$9rB B Wv()TeQT`:`(i`CWsyQ4B WpvK^Co*\Xxz戉&aH0C0dl$[FAKUw(H[WAj Tt Kq*e!Ȑ.uκILMIsr3JoM r[^6.U֚ukN:uE0 3'I!A(uƨi|%O pY(تBeT @;hϡ  B "g"-1]Rx Ql2OeX{፨Y;s 'Y%kt,Cl\hVnmW9˧=3.{I|Ԯ^ c( }W\R8=?LۋfSLK(WdAE|s{:_%g("ds"MrCJر,ዢ"ͬDd F ˴ѱJ6f W85q$7-FlF*q]+rY9CשvݦH-E_Υ#BP%<aD S]051طRCȟ]s' 27+w?@8{@S5,l@`hnffwifZRɏ5H92O}u6x(ft |KJrx0'5(@"Wl1zYHKR<ﻡ?INjbKg,RsB(wSB=*{|n<jR&[Z"Tevp ]ZӒ|^HlԾ~~D֑zM&Vi̲Ucg{r`QjXIk:pZ*a–9|k{г}(tWڥ>-ozӟ064蒊ˆZIs+/Z D&Ud0=kJ]rE'q^)^+XX>vd[-tdBoܾ>Ҹ!EF>c٪O6! m]PZ _cNK)jwmj9Np惊gNWC2SeK" "~;)pHx%nz%mdݺ{>d k !h7$BGksa V\:Ur!y fTjFhͶ"2Y TO_ǺS~=bIç`jP?T3u1J7A%f( %R vF@%?aTm&>/>h'֪x^b+S5/KPwb`8UPc:͒jݳgQ??4<6膘[SD@֯5]oTN+|#}8ƻ=p#Bg `Q{X—Z H}F$zerg1,=X2;&0t9܉dX}k"̃5pS9/;KakVhY))Dcm8spURXhbRQ'>\fS6 7+lщS <_6JDQt뛣v #Gg)09Re))B@~hOO"T]k.C_1&MHNSԡuZc̭эg'GOFt43-s8d}BD{Fԧ >{E8iJx CS wx-.#IqSt`, 7g9f8Jnq{>^*=R-/x:b0ߒN82f@o~#E<`,Ÿ~FuXU:.D8XZ=/О;'J1N*,m*w/Ii.0s/ԕF{xAň?%ɩUv6.Q.K+){ꔸONKnD9bR@cn%-ᱩU-4ٖ, n4*b ?RWkU .^zRҤJ3?`2a~r2aO?"*pTgk;$e~ºQ7 }=Wԛ돚Dm=ށK~!`cc3?Dy`eL *y5@$ͳY,cH% HnA6_{p# ҇!ѪU2ZxVE:6HT#%Gx#fCRO,DʿC\$#Z$V ?ң22Ub]gHEJUp&6<(|*]M9Y%hmT$lOΜ&3[Ӆ[ *v1DljY!QXG$?0W\ƶ膠 QUI *U-Tr:qyQdq+ W ܼ܃4g'q ?F'|sp1?8V259Z~s-X{ ZW {<`. NZRP1h |X|sXs_C5wƕKJhV nXQF831!Fc}7`nΫ6m '8-E -0_6NKK;-Ay]zZSW3vr-Z*OFB/&s} /G<)Ax:?ԝ8BTĠLSoZ?(#ܸpv#|KNTͻ"a &wQbDwf::^?)v.iOqB0P{IƤc޻DiC1k"W Bʈ=Qn7SRǒXPcẗ)@>cv;a#ׂU_v!C,yQpDb3Ev0RȗIΐc%;o#JHP~~´&7 Haj8bS{PfM 93]ѬV}ޏJO!lL 8e.?z*88Ћ[ѣsz-+pt K gӕw ܛ'@5:L{΁ug9u)_D?=XRahE+ }Qy8٣\?$:Xph\@h0Fhǵkdr )eQO!xS`mܟB H&1F>`4k?ܩV^Q.Nss71cbc@b$ӧ$E(SHⷲd7G€mj,5:l=B=t%J@<@s'Xls<1ts-X G4M`7^b ` F;+Bf ɒ D`5$J2F(rِrOI9 Di(fc]Ό)dBT8tW +"sF#z7i`'"& ^OQ3ynHQF?a[>[uYkd3#tR0`fJp$[)s7(3Eh4Q}QI!#2EZ@ Nł\\%0I7_Kʰgn,T 4ЧG"_<%Ksxᶉ#BRkR2A\RVv!KZc'2dQBBEnо 8QRO-+^J, TQ\NA;Cn BLCifŕ_tCu͓  a{֩YdW2D"À@Lmp_!%Zm@ﴛ_61 0nqحy>ۤLU!'M(j-LDwܡGx5Ȥer-MIPw4M@wN w XE@sZ[en@t߲YsE#T kB>+b!-\g>&,ͨV̯.6:|&%;#TW>3 rL ^kNd!_vb.hƙj F5GdM}aw^eVPV0N^oMr;4o;^\!K_G1XkV4((4p-k8NQsm+3"Wy l16),t ^H/Lؔg Q6Fj [n1zd1J9K _(2M^n2r'y1 wfz#37tťg /U1ECf e`-??3HR؍&Qt2-3nYlQWPyp X׌SB_9GFESffx rEw;WaϷm&;w%ʺ-1}se ;tM|Wze}"ED?Y~`Yѷny' %n>~%GtQ|#@\tXZ߰86:&9\y (r?x%4 Xخ+N|zn 㩆k*_k" FQX6u]^)Ȥ6P_3jY/|ET[\ZBRiIoÙS2Jdfd0XzP] VepOh?[ E@g)~l%B !Rw!:y7p'̒&܏zEzuCWpZ)e Fm)%' b3Kx)O8'oLs4!F%ypeuƠ\|/$$n)/TpЏi|HLrY d%\8RWfY=hᕪޒU3wW2zr5f%Hn/^'B?WfG.^\6^՜C' {>=Wx5Dy*JhQ-DB0ZD"QU(2Q8&)oD,GdwPLq"*UJa  %2񖪽bݳs!Ril%c D%aǰWe0ƢZJJ,vkiP\ Ynk2y,Xy82l[ܟO|wpaMO♞R?WDO[5' ȏ)0}i=%4o{BB+)sePqDGH'U r1Wvss+ңQQW>:*;u'mXFO̫BX7C6%G]O ʶ7&F4 11ݮE>0>!VmnL5&IcC& 3 ;nՌdg&A/-e(*uw@/^aP \;Ʊ\7Cן16HL I=TcoLoerȠW]'b,KoN>reʯۮ]rJ9L!TBok~啽 y25b;2яi ̫=nIuR`Gdž5ik*hΠ,QšLI1wP7JNʪA ͬ"+ Gv$M4p8dNLȀ,55dJMw㻑_N\Ԟ޶lj2}oU{ÖMO0.\=Fc6XͩD"/`ʗ|6J C~!j]M 9kB0Ɔ)n1 ~/CRdZ,{1jgYaz#N%-k< ;`*Stk9H8BJt,MɨO"cJJ<.<&@^JwKm R!wԮr&/"ג[7U^.{q*."=o_+jPڗvFzeƙnW45= >z4" PaSu #_940nhɉ"T6Uzb: >VPtZ׌D3qܠ,hB[Y6Ԣ=3H3L&I[fHrK6&zy3M!>?T`7 La$cFQKi!4tSPz9_t?I+׵W xJќЄlыU@^LkL4Od\d=/{` /畂pᩰO;S)w"1c/ZNsqzޕ¶șSE=rYP4>K -,XLo|5##3WUOֲAVy)NR4Nb_>*rX3fqzhpMcZXjH*eQ!:ay#ck^VԚԚUdKG&,w$E`KXFՇhI5bʞ\qvu:MιC:0  eNij" vgXuu G95v4NLJ}hrժދ&D; &r2Yb<֨=-]#oJIW1 R ʚ%ƺ dd+W@62J~n$Ni{%{Et=l`Ά3\0PUx=ἅA ɋY; 6ߛtw^ocÛ< >L%שaZۤR{*u^r\hv |~hptw% *QyBpd%-%%vuT\2sF5M|/l6!_ZinqIʕMω3Gڒ+Z帻M~Z,r>qP?t(7l3h!ǪOo1EgA0X;pՀ5v\Kʪ[b5L~Phg2dF Ei}ft;V{vL_ҷ9$"~9^ XcGX厢\f)܎B.FR7x% i DV=sR4rC^q_9ڕ@TxpjyqX[rU͢ߪгY:۱WU^4`&\t_#ji l ]N-7->]?c*@K;1aMR,0=ce}Lz6 \ T(}m ,7#"+5q&=y%2%+,3e*Z<%Zk}EWe>eYIJ:s*v2AuHLjs;Kygޑ׏LO]<p;應9iӯ-+8q )"{NGAeDٴYWBD=dԧ_|rHoQ:*:H $j#)ۛ/g 8Gh]M{pǕ=ƫR,id:3or=NcR@ٵ'~Kgl|Y%Aq4V-&w"[^ԃ3U>{&D0SGca&P[='}Zv4 y~[[y`TL+gxD0R>6a/O:pCyV  v -(h|(U!;3,al8!)fሶ(Kkql08k8+?6r{\w)Ef>V9r.E}bnRv9&2+ !=dA_0EWKsc:8#H4Υ%`ߋda l|*>oĉVU=v_x#na(_ ֽⅠg4hp rv zblu(Tƀ4 ]>1;)؞E;ַSoA N(WzċZ=;&~wCY$B1eXG&bJ`sv!_F18kHlGZ V}o\wM;?uC=;9`3SA;&eY/FPS+L/tCrhn {J\%|'+p Cf Vәe**tv_r+Wv0w>BӪz `yYNRLLql_ݡdjM > + j$7?cY?#2zI{it^2(1ڬs>}HjSf %xĘQpjYk)cx߁ hGyI`bV؍ŧ58V"? przb7BLr g tkќ7s k}y flbݥY|B˶QzHl?[gR2 D66oR|N-6ҏRh(r(m; !W(hmzO ~wLIH&&2M,Yڦ?[nB4rЉ™!`Sm3udO!T~W@=$wgrB@H^jI}(о@ V t\2h&Pzrx~:1WXA)Qϯ.@񣓥pdՂM߉k@L|shzΠ48ʊ`LGWLy~B>Q@mYBDF/|W580!+8_BFis\nT^N˼5fFxVJ\#ym>)ry 4@L;<*vB Hd!th8oGvmk~ط#.Qׄxf`4w7p<X r s]IK [e-M9;ε2C).Cmz% rC+U#iyeWۀdɾ<0//+\NO7y= IN<;irϩ22ΜHNis]hmr<דq J^<))MGB%YTI9 02[Xb2)tK֛z%5 :LR@r_FqGc\ڢ~ao\cPu5#0s]Tn% 2*EhEsI~J >tQ[OgVJBE`CzmK$|:Y$g`=um=pjG다̑9I6>*Kwӂ 錨zżtw ՃzԄb*!3n,5\Bvj\``}MF}}1/b(D;hTEIq2B0Ivkbw>[K 6/:Hl;O)hl9 o!&= wH/ɮ0ֳFGu)SH$ 6L6MjK7f40koka͓REiEw⛙e.~a o@LD 5U]`˃@!h^N&}Ǩ3Z k#^h63ڨ붥p=Y,Q9 prF ͏]kW׼n;[ !Ɍ U0+w TpI$̓ߨY6_cʏ<}[H;fz?|]Iӫnҩ&N*?Yt{.[4ܿ(iGpbd0P=Uc#$]hr:RQH&pz{snb>! pXx9W4p ŸŽRΛWʢU?$m~j*Tlt,})΋$܄Bf9B[tXni+{QnVT!S6sœXPg0:e̴ϓNqq!]r x8dZL{mCrw_HvKл5' xe6佊Q!5^R3YT Ke廤J)f|cv\N& .jBk}Wu"tiO|ZC`S=}좓]. j/Be<28󄾥򖇷f)!鶭+p,/$u_7Kޥ^Ҽ{ b/CuE|𿕗֗*~4#.WBGL5|/;)6fFOy&F]98I%GuC~|"fQbEԽ_49WdMH)O% 4tX Cp.Tl0ڴ9OcfPG&Kw$JXU#gҢgW;,_HI(DδB\JJyI9kHk\rK5tBz g =܊cװ lbxbr:iG K _|9654aJ uw sG~;l!kRS,@'_7BrL"d3(%-%Ji;rjno]Na:])__ϪQ@ᩉ L]gSе pgكS޶pJH{ fޅւb0p䚎5[Anx'% W&mXS5hyBdfvAU)5~w=I~ =6ܩ~.O`ٓus-6u7Т-Α[{e㝋>>n4/%H}CIc;, VU.k.g#z fQH`n@Sōn/V'J}Ł? xIͽ3gsAIM}JKRa>)+4tgPFA,r%E=B\UݱG-8S]ҳȈ> alhk23em;Ncrqwk Zz9xۛdxWg@:Jxsuƭ=.g,r>P1HSʖ~q3'>S-OPS'Q2XhcaNpb!I^v9,F_~ӊ.8hfn[W&?(.۬AEuPs /< * ^hcm eŪk:,{UDνB?K]mQ9%-cDuAїZYvo< TG'܈pl)<'[uHjp7&7>'3+tJH4s7GDōa%W/Qޅ/N3aNrݢgV h{PPA1[_skPG;\9ȅR(iyfe.q,zɯ`>ס3Ew[WqQUK PCsY4_9r].-?B0ky QN0bcDz~w ϖE'x";*V"BeԢhTة Ɠ]u0ϛ$ 4{OjT5d"0cEbX]M8bC =ToD[ώ3bh#t.o86` =|pBVpᏴafeQ")/&|_8xG~iW~0dFHjQuS+~vHk2g~+f]G@a,{$T ?D&-Txs^5-=|x @;r/<2!;Q?XRVEBM$iq\`KVaRNbU_llPe$6;i߱;]hXZTxaCJwX\FYEy|7LM,>IG`ko_`DP+!y:㻭w5Ðr@L^5ʞ c)?|L=s-R^4A8ĹO* ǾFh?Í)5tϥ/8^F=myWF3̑mKntլ7ϋ1:"9`>+îqH8Ĉ6K lVX Z85'$b[:_(m-5"`]1{aŎ?y/#3I#j`5S|AV̤N3#[A}Y:1 FOjLA9^T5SDY]-\3$MMOcZ‘l>Azx "f i5P6]:eA9L{=%9xV$u"gѭus+FB9hja ЎIYO|izǕ"ij~T$UNG-IYV68?pWcfˣFخKJx:%`b12Ct(SfNrP4N0g2r1љ:JaZ }6SX?rq9pa`s$ƫULMApimP;XFq H#L)d5ZY2O2!fVT9p9]dFS}oVZ 5]sI*B$CebX*=+@8qV^6a\󾧫͘mN/6cnQ R[$ gꈟ+1jLjB<Qn142VPް#oddguY7!4kҽaDiI)hlY\Ќo(uOLRθCgi^(ܑNy^ 65kcp%d!7#Ҫ6vc=k$"zp%2vluG0.dj,=f[{>K8Ru"DRoq|rr-: WvVX׏3Ix8FF`. Pͫk㰸-Ɗf'}9M ik{Va'a I:51,&w̫7v<4rwNZ#m7Kٶc2e)lj QbN;3݇Qb%B\IO?cx,"Cs{?g16rӽ 2TlֽBYwW٣skA guUMTil`:]gr)$97XF*~'XrR=ЀZoy*p4DSn/殀x-e|ԫJnE86iYCLD]=j2\D!D顃qM./i2;teF؆]?s +udgөܱMۚBqWCEꬌ?:sA䦏;-XiVA_5h*DͺA#Os;pN{(\1!= p P\ 9LQ"cuTB쌞e )o Օ MP}aD-X`I~/,Ҙu f5>EQkg&r8#<]##]}YLp|KAK9NuM(O'UQ؍4gF6)̵ Mu0#¥8ʔ͙x{Q9TR=+LO'ڏ}4x׮̜gBGt;^ :WژAD‡8JIBТ .>9#Vus/ѧVߣV V@f:U eU~}pK8N׈ܹm-gVp[goq)RC]ę/b0Kފ!g]Ln+# j@˺o WҸ,Kn6%Haxa7T3f.'SJfҡyA&27.B@勉fV)1d2b<HRY/OqםV1sZ3KȌRgbBr+#7sA]"Ol M}ɤ2L\ViTKmPM\5Kнb$ŢQMhp~-Qw=܌3Ft502Nb*na8ˑ*43:+)KSU5ˈJ@B3l3Їb|0VÞzւld=Z㢛) rtd.g74GWG\zr9J/8 $̬7ScG:Ng%8EkH_5J H .c\%)C J$2ti@zL(qJJ!*^X$|/o|<Ǫ Ntuʂf\D h T?^#`e3{2˞[&qfE/OFYT ys44D > Huӯc7݅xq\Jq(Fcns(@rw* =-{#zח؊"hYgĦn2wnY SG~_Çl&i( j;f'z1F1!v'%v/8|[$R$nǍd/9] `aQ'v䑛~蒑T_$؆zɥq w9]%+RSkR\2V?φpdEb2Ϗ\]IWm˾B"oP%[SxKSB_0؊DZkwrf0>*t14Se߫KPM8E >)DIpӐGġثqO`~ɒf|(0gLMdIVvX/1"~!fݬn[y-"m+TGTpj<4Uk`x>GA ΃aM!w|,e?J\cq?6 )IQ+J# EH}nPDbi7=( qE?*s+)1ً4\XJ KPec|%p<}L3<alW@b#%tZXGmQ2gHhL`Ggge!*vzSX>f19WJu(?2=?oKlyUP}E=o/;ug}Wӣ"4&MVX|w ZEN$UeylXy]Z3c(Ԥ5#Noed:k h.mĘ=#&"$*,Z X[U]-5px(f%&[! zR} ;,[_|9 N`OUujOU:Ysw'nm28: ͡ț Ijw 6 G|Kyf-aپMJ~5=0<|H(M?s,g |Tsˁ3UJiN\MN߮ x&fۭTU>Dݞ:9nvXTzSȓu)C;1BOw틭}enc*GK:Eig| ""]dz 7f @L=jV%ba}K4\Ǝ:9Q~d EW|P< ߐ>/E@t:rBLw,eÈ3 J ҤSYզٚ/Y˨ԭIGw>" 1N Ne@Xyp -\7S]M2]_)hN3bZ&(Zawmb+VniLs$Z^wgW5u3Yjdjx E $$3ɬ訝x[۬3&z|(lުgV|B:JC㔬m񺷅cvs\*tj^_nkg[u&P`~ѵ?)['7*jfUBvP? 7ۣ;] [=r!!"m!"f9mFu4;[LNuU/|oe}xT@ͬ)mʈ8T>7qGb^yqwtOY%}ya#:.l'Jmrh Rvi ='Gʺ 1.CZnq޽" H!~ `")q&׍ P̺nqk&;o7:а!N[R!Iϧ1+@m+&KrI Ŧ1KA LK=: w=ǓTGo$&싡aeς;觫,n0F8{4iަqxeRPeP@P]-fBeÃD Rxu͌Q9n-B6L)7vTf٥.?6tx4-kipken>=?_NDȧfDwRMnR. qcEO&(p&poC_@؟v [U*gt~'_>P6] b _plӧE=yQW K` J1|ű5䬯5#:DK-%+7eE1ĭ DqxrHmN#<7b6 [4>Eͣ=)W wx+!3p)  ǟz mC+IO{D,(pKw?Ex&L׵D,9&l6(𝡪EF'\k(vCFJCMɬюIҿievߧ;mqnswXn}\BFSL뼩S g"Aeeťn(%1ԂTdf}UhpDaWK{Od]UqqU%g6o%t$lgarQ8P57΢7{M4T $_'Hȅ`v2۠(#|RoNR7)k չrG+  yzm{J7nQ i}|7F)hB!wϷW$'b8coH>)R^>~dH/>- :U[)P2p֗{-á?ZM]pW@#,Vhl6- 9fOQR1ۏkNb9=v-UcFڟ󆣰2Bo㺬]6{nd}p{V肂0Er^7/p7yﵪ;lVںϨ@ qs7빽8o:Ļ[U1pބ3lc<"h+(W|CEr!ŸcUi<_l..v/u2E[BM> ҁ0i=Nr62(ppyp%Fr|T47%HZ3lR;I1}8OGaIֺJM6+0UffM6NaqF5rjNmvcfĎKKM yʍ;s {k2L[Ba/{p?z~tdlO wu; 08#m[h6]B޽yC3^T `"sBM8ؕ,c2ix5NO\}E'գ*:g| Jc~f <r/M++hFa8">xȰs7? NDxЫ}{SK('¦:J[Uv8NxnuVd$Y-nd]!ѭ\W0cşcA}ʔ]+=m9PyOIXc7LM- Bxgh zٚqS_#.D=.<26D$u[gǒ>ɏ18؈CS))!37[iS~PA-"[5[&6$n0-ZmY+iGh2MYd܏$Z~w[ţ|f[%sQ-#lf`_$O&F4Zuk)]uU^րiŴ&hP";c)z\DMew|BQrn{J<=)!Àz$@O{El4}ǽ= fSEμwb!M gzż%U>=޽>%!ÿD=jRܧ4Zpb)#T1Be)#rsvqtż;Xud0"9i8׫-b-64pp7|ҟB)K92\!23%]=|8aUwti^qql9&l#VțY^Nn\cmkڜ BD^׻Vml+ ݱ/.=j.5Fv希w Zan;6]9tuN嬯L މ2]Ϙ@o֑Ug@[f{$O HmmiVڊ@)V- e oRZ?L2 ݮ2[+ƳF^9lVBz ͹<+u7NEێrXጺjc2Ƹ3BWgG)`ٿA}(ñwA;O k&0pPsݭaZ8 %j'~71~GHԇltW&օ`s-k|Cy>NC`kge띺&ƅ.lQq+ďB6QN|d{4bQXO}FcP^^2!c|x9<5o ߱!I*ib P:NKyv _gi-R*r깨hOHq ,OlDSq˪M1%Cܘ# ]^2wLwVpdHn嬨#Um@6V|0^5Y-^ԹJ4GgU}@O*P1 |\dnC-l R6o~'Gb#,~ +heǴkhO-h^\{\`]FV /[{v o5:h 85bm*GCԣM-Ѵf, x|f/̞4Ǵ|(ba~18Yͻ)>^C3I!;hDA:2u,yB*!eq;ʖx{]t4Mf(D@I[-OC /{  L] nfv.v2LNRT7̃irΟa>^3XE0'  ᡥgSyq52P]ƌ(v"Uι3Q*_V1:8Y.Kzfs #Lpa`s@%"]0k^\%]~{D"BY&ɧIF{7 DLoX7}ck!(GnrP^66_pbRXHH7. P8ؘhThI<ދ7gGeR; ;>9-gU`0=-6Ku`Rs=Snp65d.woynH"l;~l Dj7G&~qr,.9$H _~._4r=S<0xلg=AC!!Íf4rGa; L!s ܞ ""aZ=#SmR 1۵;Qf =4.jUkQ_XK$Q 2{ SMYu@b^T)i}Z1D[Nuѓ@~~ %ДI%kPZ g40{o=gڗQpDElS:]W5 V0('c8 (]iRt4}q>wC` 1F!enIm}ϗ+= )_Z@~n<,q@ &l%d/[Ba%χY ȥz>Z@f0w"3vm#LF':oSO DPqWA.rXrk 3f^qF5HnmEe5S?}|66YܴT ZŸ^7W{Pء FƦl冭QRՈ-vy>p_鱕 ?XdJyhtn*TiOM͈ӼrHK3 OK_${/iiztO# SMƀ+I G+Etiz.oc,Co$8j }u&c29Y{Q9$Zq;7@}ăS үbyTn,cOtLC7j׃<&Mu۾xc;n?ik-?2g54/P>($SݕeQ-Z39N\w]V7K +G--GH: _,uwӕsKX`L㒖ȥh1!:A%=.mQp=YQ1F[@]SSycCޢ/ӣdry1T1ɞTi3CI Ma VLWq$E4[j: Xnn@J{BϗEON(tr( :H̿V-A( ьWzP Zt{`E1φϪ :R:Aչ֗1\Y=oVde#gRۜ8r<+;N޷)]` L8qnɱ[;Le> 0:yxF}F<.BdBHi:G?AK G0RF7okZO*|uF}JsڛK(l`竌X=Q&i9O8Hw!oDS.nȧ驅=$8941~6e̛,HxNnpWG{r^,sðgڞx5 ]t@ OI-,C6l<>{F╰ aiZӬ#胒@E8Q k13g׈D\Sk𼨩Cx) X<:G%l%D@ 4'GXۿ4Ԑ)Fݡ }'2r04 rq)S!ͩp7*&y3Y@8C6# "A; -~' 31k7x-7"G H׎#Xy쭯 HuXoᥪU]"T=۳^/E*+v.C*Yq::TPuCUfx{g{LXĦTswofNd$nRk6dFE ΢R~n. 1@4yBM{h$a9y]R/O6܍'kU+7:ȟuǨk#"aoӊM<ـ}dmOyQ3;F?깻 I"IJFI-QOMVͽ[I1&_V 6AS{R]m7GS3Fx=6782{UwG ݴ<>ާe%RԀ!>C-۲Ρ׏~_6\%."y+(C2 t_N#Q!*Y/V#.̓XBC:.XSszf>}`Mj($(:;*/L|J]6Ȝ^N>jr8uDO┃T<{r M/ҋ-4A"ȾKdݔ)g$?fL1o9b:}dALwВU4!|SScȮ!~.$&U;RXk+ MiDBBVUbN>!=pEOaUӷyi4)N:yRHD(_r%&+NvQYKr:_[>/5D^M "TU ڍftaT?LK3~TؾS˽1nFq$cQ Hh :tJ`3&*Tv@(NNOb5ߏhwȟDA{H_Q}#+㤗6 >¤x+K &/K͊Aµ JptDWV8WO!s(#$X"M0Yj!< vy9قwӬ>C _[ np)ȯ+ N|NaƊ =3"FjK0 ۵q[ED0+arQе=[ˁl0X `Sm\w \$ /ˠM 3yP'F`;qwS^,{JU.DxۀCʹ&.uOQza7;iyiəi*^-b={HܺRx4u)5Z<}d/1ON,[d*dVn(mc|R$T`M<3q]d#NAPK')m7JɄw`jْŗmfg_uNc`2O3` s1Ľ^kmD хUE%,:7m9R N'GKw/ -C`GhA% 5N@Yˢ*)ߖ#1̽8SBMC)V6;&^}r*P|hG]$?TEu}X2]% ̲ibfF-f(%tLvYb!.Ϊ((|Л"BS o7(/9!63gEW8 ,2*ƣ9U ot֓Hk\Ÿ(;_,_nX<ɓ''`*2RW%nGb[zڊԅgKN%U({{_#ltނzh3=͑?ufhc`E2gvX'H7}^ANNWv%]cE ζ fbt p/3˭(^v <ecՅG, a'ӎp7c:V ^ċQ]Lܘ[Ɍx=N05e_J+prA{ ..][3y PJ;7wrV[۳$.kFc#Fq=9plAܬ=uۖv 1w` 1iJw&xȷB'ʰf\Y7}d |+w+@KE1L>#ѻ$c8LYiJrr-yq?>V]Љ)p{I}msDUiZֳºS-Y~ngqpCy^8_OLG`Ő0 Yr|_C.<>4ܸ$10؂{P2a^臶cZX$br4N 8Z6Dd OrGV9?#N5k| -]k'V Gn>u̔V~XzҐ.wy*_w/jRJD}KeL.!{,/rGiʗ촋M)9B:F(!݋~X;\@@@f܁>ifG;l @VEmYl>)rk{Xd黒o(s. *V)iXXn ,v "<7=bOmko~sNJ4jnN?b͒bTNN@x کԬ z-zf2_f)MڏNIU}fKJܦwqaĩ(WOBm˞>I՘NGTR+ƀgT%bc|Rzn8@nZu]+W} wBԆ.Q[rA+\}ֳ)!? : Xai8U?ԪA17K?Q0NO&ʦx_UF PuBQ.7삞Ǜ1aHTLMP &XOÄnBc?E`o̮&g`/Up牑O )Վt$+7]5滪rd)idjF9lBJMՉT 9(q GsQWEﾠ\2-Ggu$3~K=wL;Cj\*v>azc.뽺(BH2<Б|4ӠkV*RZcyp݀A;K|sچsU3DWעtɕ|=7Nj*H')Emh>Qlpsyh%RxeS~#m:no[߹,JMy=$})tUIUOؘGuNaL+~(]Dvtޞ |+bꑲ]-^fAR|8nD)*Mi@E,ޡԉDN*ml [O9qg}K*d\vj>-^2{ͅY!QwQx]OYlAY^HcM2cbAV}Pxjr+Z0D]a7LJ1LhAB@Pg#e|vHnԁ1I3EiyKD`d́ N#6xoB"4h;H\aq6*Krg}HP*hjϰ,^Bزglaw:4 JU{JbA ~ր]RŹSzUfi"e5/hy2b1j;}G+&*.,4 d5\S1t?r0bES %ĝBœ;% .VWO 8F=9Pg@7Siv&0`DbG8ٛ9!0f ;VZ!H5T $kna*VXVچq/>11uyʢzOt/*w8 2E8[cΖ$ S ZهԱF'o$2ma)`:d{OoVr}VGeRpb Wa^+PSL9*:r _KNmKRd?bϷ\z-I[4}[=}AV&1r'V3sܴ72p m43IS9..kֱ/ӰvYZޛ؜c+ūUF+oC?7Zb()lQ/s Bx s=jaZ>=C)w",62to a7n'@8%h;TA&1θS.M/ n)i <5oElӷDV](/"J p 6TIEd=ڡ95 BpáW|PC8Z%↭/>O=7[oJZ6Y41Ոڒj ߄3 vh#Z+ pәdTSX)H]W dپ8rwjʶ =;b:Nҫwo-UHe.CG% (q _c".U~8i\*"5$JOË|o~Q #N<*dkJPOz&b7J-&;Y5X͈6mPOl~Ko{cֻ: tK^a[m49,Lhq$`v́&L8,cNAl|ؔ:ZMROh'f/L|a3}@n=L+!aMMuz#5#x{$L߭E5`q60|Kolsk IOk~0ౠ⌀/DS?!) @y$:aCӆr*,ȖɻVySIN| |Xݬ:m\,g 2rtcdSnGZQ:1oQ񕁸.C!~ML (z/`# M(cZ;*0sxDn\V|eB|h|-1hlDT4%3Q9pZl9(' ap~x=*?Jyw(u Z_':<۫;DdoT3inTp\w.Si~O_!?-k5r8uLf3BB˶LYH!{fyS@! :;cZͱ(}׀`D{K`o8N7}_um{(7o ANzrlD7sڜ?&o* F'mաIFpGBUCS7㾁]e%|bCڪhR!j7{Kml%2xCq*W:_ny‘X57$M7q^P!WrAVr*a]b_GTT, e:!6\網 sZ(GT̓ j.=N))7%sC Rn Rf=a86mob}wt).;ʔ>eM-YϮtGݪǖ&̜Om ,%Md/{}i͸JMi}i9{"mnWi&NT'qQy?LT0[HpvzMB Xdk4"LucY>OᅉJowՃXq6H;h*whnEN*_b>R+/7rǚ? F-do$J]h_NJ@+AklrdWJ7xn4kY"'-& ygD KZnfQ9ڙq{0H;+xIw垀Ƀ'C}j4Zț<d!\8'*P AD #l϶q]C6ZwrCEN{+6іHd3ky1]! "czAA7m+ߠbx 95#f>|?'t*bG}gm wC">LIS>.x)A/S}q$D#EL;'u1dO:G43% ^f^,=Gsx0OImzV 2SsdIDWy+(uQC2l0*JGvPWP=>c8z9I9jm㙻e"tmQ0ټCj[e-^YR64>c9q1=qP$ꁤpyKr?h Ȫ3 BVFgUAm%ʎUL8i6IDtyXlwR3*{in< !wȋb45a\(y?^tۼ0H񀿃;SBdkphM9E1l.kQȏj J` !q'$ϊXۄw@}Z1g='p|#AT,BfY?2-xY].|; '_Ze>V.Z)&@i)Ү/V{l[_[Beh4tcA \V`̜:B632q@ 6R}tw)@/.^VګvezwR0(2eE fL5{\UQ6=4{C,m#<{~.5/IL[KQXi7L0"^Nm73UWώZYmS42{D8v 94v4HF4 zv{)sA| W EPp;R&s HPoE7O7]p.V`rsX N?*.2ؤÇ<+deR58p{͓O=5ycnXL$'}2v\ ,&.YfőCkճ =gFu X!yL&6,ĺM#3arøEZGxX Z= B^sXl28P{!(o;zfHA>:"fxٸKn ]JJC,YfI"9>8]{4 $$K_1f#PeU--)-W# m- ]8VTQ : giL*!q?=O'&F2)]tC)u"MPt!s{DNoee5ꚪA z޶Jd3B8]WfxK}^tœxw׆U\vyy s9+Pt /i^jeJu^'(t0x+瀡 r. I%ʚT3n#Fw9k& wN>:(^K6ִ9ERA9]gs?ywIu Ȯ:* gHojĈ>8LPr{+~Cr_ɪzO aYwpk+mSJ vny/TCRl HADS5Ô!9r0cϬ BH=b{Yـk \ӭkfBU7Cqcxƙ^60/鯔3a Iӧ@4g2a'A^!mv %!~0Er8حpcEm`j+~ kpZ*P6,5Ȼ/yj٨lu;(M}cVwןGP.48dn`!ي(0ja }3_f | e C>퇩:-o+d|<}kat,5E Z]]lM59,ԫC)eٸrfbugןɧAׅFW9t#K6Nr*>K+9tF&3LQ'͉ &@=QQ|EeuU>g;dVsilEeGW dv5Rv3^=`d[93n,mRTy hRCpn9`*!poqwօ1>XJm:frcz5OXHыOnb7&-Y ZLF"l؟BEtzO8j^;OEJ~m(-vLooDVrϱ>6?xy[k0j(N:2.(X֑6~vn-7M d(lHX cc|#Wn)}?:ꍰM疾IvP)VǤ`v '6e13QY` ਌R~:3 |VUK=U\ g$W@fB!Fw߼4k1eun⩑gRƚxWWt@ 9h#I02)^xTZ3aS xft].ОX;v?1cW϶cT=hշ?q|rfr9aEE8B繿3rCյnf,8 .UHVm_(sOm;2tAt"P*ku{mO=CϳОebqe+9@P}fʘ qY*x-Ώ-"v() TH3$+ԥC6[@ X(vx0%Ixc^iU!\ܣ+TYoyљ.=\fD繵Ze:ќV⺮AY1~qYҎGW֕SvT0J Dh]{1Ǟ nI:%E5UA9أ~@NT}mWY|Hve ~(wP@hW'Gsde$a_1R&thJVT0_os.8i]f%R؜]I7h$J00>.0찝6V5 t41`JN\UZ&:&x Zju j@_-l 2GAwWyYrU:[`BԷ}Af%mZl\+=$U4h|xgMB'7QdËYݞ&al޶l(ЯvtVBW$6} FF[((8qA.ˆ'Yu`tI. Tm"{o]牺hf Qjs0~um4A훾{x*&d ¨5qhDڋ[}IATwwk¬l prU7,82E~4a/-';vFᷱ+,fW@Kp2 綅a$|Ѧm+@:YG-HM[)J2٪f I1/R cz R˭\|$| g rK:)a{R\+۽i<d;1\C{wm 0cl^hS5(D++,`pFVH(Q X/&D n7)5>ȝHP[GP0ݵYGzߒ,ҭ y5F/h'`ܟXV^ڛ3'eGGxRgaPs"Lo>Ǝ=fϽXoy ,S0t>;/nңT uMC^%RSBēW >VY6N] m/s4ޣL߮ uIIӞoGi!6=6>[ŋ(IS)P8 fGj%cF1g%IIӘ)2VW-)PamKGc#"T42 }"IdW_SG/ڈ,N_P_xH_͙{^Qp>S*R]Q6]C 3wx! dawX%#[ pH\ȥ5>/fsC 8AJob^7HA/b5^D oRM|.j |2vDōgn?Փ:xP"h\ zqt. 6ßX86 bx^HԲP 6fs|WеLd&Oeܣ}IVl͟rrpPu B>w]VunD;rɄȵ mMĸ{u)qY袿P͇(iw(?`k}6#Ւˍg_hE4q7NMe={俴?g:8+;WXĹ$i@?/]CR(,/ըnM*N9YWLDF qF@XPN^< !ړ@H[~o]VE\CRr9݈ͭA* :W vr9VV1}Q:9NБȌxv @Mh&ݏh3kcqOxq-3cYg mjV0IЗ~X+?*]ϑ흁8.5y8m goâ{V%'ܓ6D@a(raf NU w|7ߜ$< P&F̈́+= ;Nů³MsƶlgBA@,ZXߜa~nҁcRn7u|U^ehĪ'xDt6'u40SVT{~"˨q}:-mf\5utc&i3I5~mh fSH^O\7ӈ$(vI ‡G"P/p1ȁ3\խ|F+3}$/|><b~#iZ!l+N^w٣W6&&96{M(c׻*?r|LC?nE"k&|sGČ7{G"~y3ҥ+ٳ(LNV)s4Յy|/C5;ըbJT QR EU~ۼR: 'Xa4}:\Hw7%0"($&>p< 2*^pM2UѴ&x'?+™-ЬPϑ <(? YOr|sBd#{L>&@PqmyA%%cv `AN\>M8[֣}5;U/ p~ Jc`^Yͪ,uE1qaհGƦ{v>|NJ-t^U@{Aѳ̕DT* p9X~)bt,˾/]Ң芲}Q3L)>K@>PXcÆ('_[aSQM=+­d'hOFb:xA5n)bxN uMJagήCY(8{F[@"Fyy43'*# %.IU[usA(ؿ@ Y:Q??p:kna/F ddL3}?zXtd'8Uds̉=]}%ɴ^ pGt taQĦ9?wAl&~Uo#=QMj#^n}HNb6@#cv+(x$z'&LYƕ EJ*:cY&gyZ#~ʡe(t C991#Grݷӆrbo>(&# i!_vMy5劖m~.1?ڵV !ݥ-QR@ݐ)"7ܐƿ;P*N?i CT@ ^:%x Z E` LRj-4k&$ \YX-n[dME26ui=0.&obRB !%'3^1 )u4BznbN:e/ȟX+;$^CS[qb$&D+`^DJ&ab= *NN!2JFY&13?(MN8j/!VC |vwJmY TyMv#͐ٶc x6C*GOXۍh Eջ9kr!݊;?3Ϋα/#V1M.VX0e n`lkԥ-v>*7%H+K8?gy${Pl/xY3ǥz&@sz쒴E|M1cJM[~U.wWfm$?g 1K 5(S/1=P!*l xRP vbl3> G5Q#Z"I٢֌uN&7u/ė$ Z6(B)Dž'B\@!+iKq/w J~@Dj 1;a' }!an#/[>i"ÉJXV5װw`͜fJyASt=BQkSȋڋ5-^ ǭd_ W*90?'rTdE Q5S ?!5LeS `w(MwGM( >wxiKѫG`27{GDGyJTa!SOAc72ri2q.:6Y,OkFH\ _d31o^E͉&te}j<[}lk,1*=3YGT-p2y|ȑbX 5e'5tr/q8|ۏ+&DΒvcZM|< :,\'Y ߲T.“jŏ:cŇ:Seceg׷OhIVm7JDc)xk[jR5:WۭO'd[u!>hgAe-G i[d{&qbp'<¯<ij~jnBʍ}>\~ Jp;Y{K]I r7l7;9?/ǯ>fs~٬O-8&;kxaGйV[xM\qt% I^ɔsq)kDzP_;u Rv" Et-M ؏|m 9{an˃IL!㎕]t 79ȩeZZ 3~BD`KtLC jJz}YsFl: 7*[ұF]<}Pr^q'T92t4CL$_z+TXD `GbPn!cL\՛uR,g.} 3j9j,itES&yrq|V|?(-jdo:7Qq`!2k [D T[kj;ٔyY (K) roܐC-w[P;yW^QrEt2uocc睸ˁElq3'9DtX݉A^(f%*$LGuBj_Ssc;nN ៘veTI˺9>s&u({F qs9157k);t+'Ҝ3hryǿpG+EhlsGg,c 9X>nchú4UׇW0b vU 3kvnc|L)KPhMkB'TG{>h%tdi#^,z",?,K/|bUmT3 wu*MsWQȝM; 3qeUzJǜ.x)9ZDCr߶x @UX6Xͤ^|v4s o*6bY7QH$Pq&) +ly9J#D?bȦ<9gE(xbJhB [dV-N܊W'?"Lݣذ VעCiF^ux}U. s-Ǎ~rМIBz6(m]b.t\ػ;`Gmƍzl1 0*?"׵Ru+@6۝?NeD"78Wu|({.am]\AwcPCl0 O48ڑ#O:'%ki2%/y2aДR!c& }x&Q.p3~zם JUw"(]vD`9kg}xi&(l]f\C4{X uKo? d#i]'cڜae6g)19RC.\8B\bZmx Df>C[h;1"€LrCfOg@C_2.p_KtSYX_R̥I,-5obDp? "n_zp^yDָwɒ8˼E7k+²^vȖ^^\(%  2*8Lt}jyB-8ApDxGr+'8]D@a CE],P[fx1CDr"ߢUh^`5YpW^y\x/$p`6tSi)C# 9,afvp2pCπ؏-k@>z?D2;YMl5CΝBй <2ҮUc'9qCULP%dgB giƾl L}}r3r)Y\@}T7fkXi6ue~~C#Ϸ" ,AY0ROS?GBeW or$P8E(ְ1ᵙVR`ޓ U r%<931⊀GbUB5@;:g|ׇk\2&V} YS,bJۦ uMDӬTJP[/طӒY6b2K 2{(|Qxg47uv(}I XfvZ0iQ)5Y=hYFuBD*}ڨD%< 6 r<?'Eԟ($簥٨p*&ӹX.&Id2lYwE"^CQ:z n3 bXHxǗTq\b!Ĥ2=Mk ?fWk,#őb,D%0T 7LpvOFkR3,xw` =!|?#YiiF ʡ_xyiPպw4 &c|=Wv')R:[eKdOjV)Ϲl$`Xw2>ķO`"`H zQSGXh6%񢜭th1Ȱ-J Jɍ_i8'ZhespDP5읎B#{,SjRHvʠD-U`Of|wmq]UxK)㻩ѷS"QÃ9/emċ)sG ˹|nUd k?41;b"FI/aEEEO*HT#hv߽Fe|4R0#!Su>li_ I>ff$W%L6I|@ ,9T\p[Al_TBy)=yVHz3_ݛ5o,@ W8qU"X:F 4  4s"T௠Z@UWgܤv#^m?5jQzcŚvW[hAkN/ /u3e(-1vU$Mp9%-KlrI\](HTcge!c X7{ޝ(t|-FrOMB4?SNl7ՓsK݉Рô }Z,V" kjo0Ein1̇fn_ Ctܛ"cǂvF9V>0F J/hpUDͯfsrX{gfr2#]r̋6 w@)p)QD|kTrzv|rC5bۓk5z=}zψiףzU[v{벊ۄėo H+pWd<~._;˥,!hǩvʕHTklډvs15p÷:2a`Q qFc3ԫXW503UReյ+gNe׵Q"Q Dj=px$IP= _ ШÈn$Jbއ?$czuf{礤%‘:5ߪb:#0;;e;E4\)_+jT==AemR3A[12VTގ9m7"T&׼FBܡy['G6PĬVRi[(R>@4jbts͖sEIeq\6ߧ#R:EcӝAѝ\OAvGt'~u.R޲W53 7i-ND".&`M?.:_ÏȰ%b g}AOaj[ M25"rZ.}#$11`(! LsU+!()GbČ˲fv>cQ"C ᏠBjg eN|Ff82UռoܐD$tYҨIvp-DCqQK"6*+ɶEo޷q$PJ==)o/ wv3$\Dzx C C ;5O8@9$ n6!tuO MF-ş0/fŴ[/8`jeEje ĺL^X:EaaYI0؏+hڪVze.AmQ`}߉B$eN!s۳c~RFO[mY/*?,Zd'a$p!iۑRVo_/Fo,QfN0G *@äi+3S7IXFL*K,P}a9Ke[fD0Ӎm&)0/m|rټI#2~uN.oG PsVvCC.RQhڮWq?{:.Xn}Tuz@]ip6/1\ʥ zSҰ1TӀ䓷1\pHM2{si4èbzo,fϧHĞ5xw”vf~`2;|soܺBbsێ!P1 n q59w+4i[F^NN@QP< u^ŗXp 5m2A롈~C⃲D\p^ +ͩ _KT\ρD<0[TZ%We]m:&dE%;kf]Y%r=KC] 0 s?[>ƳOeg;~[Jߵbu o_Y,: w L>vUF{ dINr#pVjd0~|dōnaDtnKPyz6 &N=I FAJ)vh w442EE!Yw4̋1gxxgQQ63T&U.b?-KOŮIR b[$ arjGնp(oWNfi i{P?0# ` ET߭]7jf3=B7Χ]zLv'#!նnjIQQ=q5.Q- f"Fyx@/;]Fp}An`rBM&^jf$7GTAn ƛMِW;fb|(kTn'fؖ yPm!WAfY; c?k1՘(:,`utuw/LM#` ~vǸYؕ`zyXg[f"8 g[NFzf7ch_[JZl}xx\Hr6E'ɠSKqo|@0mT='=ekh}ym6X f.ۼ`x0fZ|ύ-U{?{LٱjxzwԴo!bYY&L^HoEa)qwoL.D|<(̢дPoeM=mu?DpvmsH RblR&kZ, `OaT`;k#mJ-l]w[Ф&"B:Gynt5!@7BaUqys1RH {NxͺjF3ΟG-g8ذYXoZt}>| R.f~<1ƃC3n__o❊;͙c5YY{BBrͨ_4]\s bKkVBFVfLVZө(F/qJJF]jvwƃM,n>dI@5mPz5\I5l!>yl VK~kE$=ZKZC6Hgay7߆+ś@8P>7+f}¢]2$,2-.Ox*+ TQ 9FH$Pv[FvjSk"4~1Pf+Ӭ$vy --'3="rg mt#7BW Řmb-۫307 _\٭g[laP] MxrK>CiaԚMqf0p{٭IeȞaR0T$* O::TԽ01b?޴e984* (l&U1v1"pQAd)TTM2A†Y{G_!W(@)X[!M ҏS`0ɾl/̩(%+r#&&=9oV/)8Fz0b+X>^òhk^C.u +JRx!FOSn"Ji:{؅ ïI##!;Eyz+ovU)UJ/,V5PTr)]c<&ާg×hiom[k4zSz^)/6$>!B/62AI@0Yu_X]}cvm66ݪPY]8wRY1>/,I90{׍pE?Wd6!Y;FyO"83BUolIUv|;Q yki."p0fb1Ƞ22hhO Iycd`Ń:A[OJOE WnLܲ]}aL1[+eնP-!C Ls`q-s<j&tG&hނEbFbc24.jQz+`:_S,#T!w=o@⧿E-d,P87$hI"akw%žۥ<*t߾%\4q:V/҉<'e@b@J`)GeKːT1ȓbX =SٮL m7zi f5iWL]D-'qa9|2rܺ^̈&_ JGe/ڥ~Nv"ÖbP_cF$S<{\:~€s>g˵7J*]MpHݐV97:`[H'>cLsfAG9cr||r "F';*+O6]=:E_AInL}JAjOp!󵆼HJ(Y'Z:>Ϳt0Hhͣ|:¾g2zp`_rҜ<f.0hw.n-o[*_hgJϋQa@LF@{W{oN Qg'&uI]ؐ(o1v'8FsJb`dpj+':n4m9$<9S\p}e9.r;fY[yGk@ja~pyq3g8i@Iy. FY]~/[ubTl)onHmtwMdvZQ+]~6}tC@%imde{H OTh^ܮzIbՔ'}=$`É-۹;q@ ]yOc{ &ǔLJ B[!eW?'.:kNˣ5µJ].>N~iI3}{Y8~p'B?UVKc4߉'L,!bdf#6 R*bR0Ionw?U"h Y#Bf8+ܼem.xRȏʒ幡oY3!9v'Ԍ@v@::gܚn^{$0|ZMzwz䠵Ʃl7*;xSϠcY>xpe75T{a' 4~f9|9*GeMT)ɱq q2B%Dw/iقOǫsh.y&ܴ'[j\R{_ͺ~g:cx佖1"uP7ѡ(Y@ԾLIc@'Nx!.rwmoԬ$4~`P~bu6x?[FFl@&ّXj R#-d(ث'&• 6HsNOsrWl8嬍=]q0 _,a!鍋2B Q " GId2]A^kUw̴-\DGo~&l YmӬ5'"ʔ_꡵+S9 dx`B>\AWͺ O-7fkގK_oS!5M'l *1}cX.}\%Qik@PijdMz`_~@b_HQR`ݧdԯ>8WoY0Ct,wwj+i.d2:gmUYC\g=,(Cvw>wBg-7Y)[M {,wY,LL_Yufn&§*Zh+GS1߼نWޏj-(\҅4:X>7~94\qW:np*p 05T\n]囯fvϪ@vy4ߏ, !,|c/[򓿗,d̯>Yz2oXvX@WfPvUxAA:d4UW,OÃAncG͗w oM u iA~1z![z -ZI*{wޭhdN]n͉n}Hs'\"0ξ!Q$tjX.&uT\&ŗB︵/qZ Nʂ0|(b\SESjW/GCg ZĬj#˴yyCiI wMNPaX.:0 KGƌZFE_%cxHNQZ1?YX$`/:v{x .EB᩟~4!>nG?3*5+[ >9g}@k\*ka͚E=H ;k&qOP|ϓ'oKz]!,.E %|Ȝpmq@Ȟ1ELkzs2tN9VPnE&sHDȄ * +i"#ͱ PYre {RvuJvҍk6K@f`1ta8#"qhطr?xg w56Kh˱l(Nj $iV|s(d!Γo/qh?"? K9u=VF>mO1m9U%k~z&aE}XB{ Jބvl*AGN,\ڕ ceEx|'RaH@AfI&?1#8:}.?/!/Rx6f!?B^JȌ̌#rń 77s*7m]* cD!s8 ƽoEӨ'cytol1LvW½-g嗢eDkPɫ ,;G/G=KgP"Ts? 1EQ eV#毅rH~yx}SU\Xx'5h4if")E pRn.?^;>ҐSH.FcJSYֆ5B$H28 c>ѵ;bӒCJPAn=*`;*OInz 2%"+L+e0p<5:>X{=Xs.ILZ64Kkoc4A#ߎgi19XFI # 6̯j-1kԙmrph#S~Ġ9N[ѻΓ֡ܚN}LmRT!RM +J=%rJPz<e$^9N"@|g پ\"ECӞbW DA=7LQ_wP#ݲ虺_ o5hSچ m|Stz_si7 ɿSDm|\u4D]ujNbb^csc^nГnV}kq nz~'Wdp}5=VD4ek)t "_5ŎA0/얟}ưI,0`ԋ> ]/q/-SI#OT}ZK-uJ\L:st3.Pǿ6fxH+9aG:Y>㵖)Df=PM_ ?Ͳ3W'鵜UJyJBy{ᬈH8i*Ư~i`2䆂-zm6E* V1cԺk2VLk:Vܒ 5бW/ ƖR8 (=5ECAyhs5Sx Lj C_a^FFtj?б3ނJ}e__:Y0(>yEW6!׊kŔ܁CфK-k W9Ⱥ,g`&q2b, w& }3# WW B-^x[e6 ij?(ec%yoCtwnB4ŪgHodsݕ򆖺W[D֛BQ"A cٸ[w KMO֧>FEdlKIz փQ{'{/\So%0'Q+~9/oa~@XHfENo&hG>C8~./jwl(g7#_H(IӲV7)yD(`/NIVF!3b-Fڱ I޾E^x<{`^ʊϿ`?5Kn=`hc$P)k`S#N:]_N[͘P?~Bu; qHy#Ğ&IKn°&+q;` ":wX0vY:&q(yL2($}mۣOdXk}{uHo>X7{'?,3aYl[u d,.-ދWELw+TĢ*hbI(/;ar]~971q0e?Z^/G?K g~+8K, mo0*5lRx呗k@{,N4`;@U'(ϑAM -I{`Sa2M_.,L=L,#H)V^\jXX'rhO2܁=+p1Xâ[Si.X[=*7s[גOq/n Fyg!!z3ؓGĐfNqu> T8l|Ep-?p[O׽= EAiaչƣ+eт=b<9F]>jO]znWRY"έ|lX#8kDBxʠC+nbamarAG1jv[i¨È8-!7LNG_LawG7y}FL̢26DX)p!bZM:{ ̸ypӒ-UzIϑC|aw499wR{p@P-k*Q az$W:b4ch_KpXZ y_r|B) SLsY}myZnF˭Ńe7ǧ%ny `ewAiq |+ڦs},|T3.WF)4TDݸZmQcBW5 |<9 le HβPW<K&3yI/W(^ ^9pvGQ@0HH%L֮)(HN='َdŲN@w( 艐RVԛNLN@!kxC0ݩVSĀ_^b^ZPk-xbI3βTc~shU]L 4dsy<-6e) >\qEPrMVU*^VЙ%u|O9\4C }4Ú]FFzK E4<6{*ad1kXW(Pn]7' F"PT!s>G[PH9&ӉBҺGpX(*]'>TΪTH܉qWUDH/۽<ĐanSsF9톶TRQn*ޫ#(:7cn97DX x}0Q7hV7/g!Lo_f^#}{5 IsƓ|ZZPz`Js߄k45I*2wVRAipж&@(;d[G7׼&ss#"?ɖlW2x||>ȎW *\עATB%S+4ޣAyKRL%f c RF s} g#'j&Gm89-ꈛUvTuQS: !5?@ڮfA@k/rwʝo1d+lC:0`)Y 혽=c zd#M-ųx숱i<i 7f9n@~ΙQ-ӗUp'*V5x]UB>yWttPѝ*')Q+DMz"CfN;)0G5u0ħ J#x;@Dz( cFYi`T.U4CvQ3gɉwGz+1JK$zouR;jad}(4 }(Vjj Kx$U~ٵ QyR5N)>9q!IJ>bf23,ɨ |҃wnr-m O&OhFea˞:l3v@_jN+T3@ Ѹ=&/S<>q= Bfh|FK ^L|$_"^SP'6o鍸lE>(2pq, !F@W$Gv;S~^Zh#39O q3}5 ȅ/G+ Lp?[}9J+!o_v2d8*w(_]:Bjؘo|hZT!\N<[ր}?6j2V?n +WkyOQ1.v PAKAO}2O\ο Pn]r5Q[m y9rxDžOl,2&Q!{xy- P)Fܩ=ioעK\[hL"oo7|0Jpiuޝ ɰ$Q+85j $0RGMzC [VU67ԤV |k'|$YV6؟n} Pn @+(7ݾ 7u 7On^,c3 B.퍠Ǝx{0LJ4,PY&|Tpbݽ R q̙`}ƏI{$\i^+eܥ7"3b̚;]m[>W<"D+D( [ʷp̽,#Mz!ʊ[8g\s>;L5]xsS yRdt59! P HrY* _?#h5w!mcc'fiwLOAk2߇d -N]v&7yݨ1\l?9@x&3cgLɤAD1vx%?og;{$,4z!@_)Svq1Y[xiTKPUHiKB"z*ۯ)YCY =嗦5,-h jb_ّaH* ,3sى76}ִAyceM߱ N }#cWϿmGyYg3 5)ɞQ N$Gr"ΛRpiE<_ G+#PI$-ʊmo5(YIe6RGKD 4;mL{1sO7@B>żd+_&2}4Lݭ82L UΙ> VEm|z =vxn97 tcq |%P:,;0r!?/AY8|$hP[N_ BU&MYs,2golX`S66Jv0/fȅ$m Ȣ6^m7/GD܍*E׵QAey筍(GYfN FD|E3]L.JŽVW<ʍǣ"]ǜɃTЪʜL?|IWHp.i g7B`Ŕ s0rQHZB۲2US/ϪIT'ӴT̥  H։IY8> y99V.'P*SهRdQEJs]o]T \f%uܨMf-déz R҅4Rq$2M*(p0nz|ii*<xADV3 Ǵ`p 0U.E%4 sJ;lKqub;];ƶ,"EH0g"da9 R$ DT~;ZZ. `[ (╡ɍuECb-x/ePtHBrڷܭߌu(k؁s\Թj5߶i//[2%a,ŦUHPR5=+`O<h=zYa2 o\Иa 7Y4VgC06]P4(:TW+N Q+&bgٙo [W2z_0yX Wv'X]kzƦY:mvpҁo3EfPvT&0^[%~ft;2bv@LlCx}bPfʈ=_IfuwjՈ/PQD}>HI칟Y.c }|>J{3"9q ly].o pT[ 칙m!-BV$ϚMC% hhr fm-ȇy:KB8|>WMƗMŮwbNxʼnY0!;i Fؿ M~QϮZqxc3ltu 8Zֆ1'/Hق8*Cc 0eA`MOJ%AIjZ$3 X4CƷ]> 'VdTPl>( 髠!#2KHt_ś83DhjL^[D,*ݰ!^*P)%V_T@{h/y~Ƌܱ"K_(oy"Jl9<4UvO' R &T#8Wo_sqbM\R ǥӅ>]Urdg +͗0Qǁg(vGq'#ׄ=kza}׵Yhq=uXuoCYu4Q_rذ:YKnЙ˯&jSogڎ *(?*j9Յ Ginz%&XDr Sj[2~} ^bW={{V)+;5Œcp|X#A4K][p ihT4(AB:Oxȧ< ‰kD~ܝȩо+bڹZŊ? T_)~쮩8d]Y XlGJ,8x:KAe/VMIx酆8;1-RM2"/Am@:NIֱ qPtU"JJPPugYVۚ}çMX\b8B@_eYbJYHX oe̜E+K{Fly7} 51IꅘfZ6(sAdv~qz"&ѻnI>7KF[:vY5lAݿf |#v(Zv#16cƺW'c2~| rur]擜{pQ1[VCvh2‚"9.8ܿ֏mkmlpF‡ g/L`F:9Uemh>\f]Fvjap.GUTh:=1yO|-w>^gS\ӭZY]bJ LjXWzZfkMKg4k>3@Μ s%;2N{(d{εܐyC~%dxT8b"`Q>Y_ ls*4Ml^~@^u\'k@D:mӈ1K{'ÛK񢺔Po&}Ce(j+iSfBm{gw;n-KcdMuMQe'gf(κU$}Uo5(?B%@-8(XQ*G14]MC X($4qR 407z BxnQp?ea(0S==N9/kfV VA067IGKHe76YiGs}w<RU,){c3aҡXӀ84%H*B 94# BGQed㜶Nz\p; c{/{UHMSk6{+{>|ڊlTbޫIa/q3b0/nPQ*wH+QJHʡYmk{@~-m M4saqhZ[HO's,|2r I~Ph% !T/&X`-ILSSph.Ә&W*_҉5 =:-9jjHbhB`7̩q> zG i vzޅ/V(O 1gXc*LSlZԚbE(V]y'ڐǀ?yܟ^pYYp~Iشf1HIcL6fgcv$'5)k՛Cks(}`5(.c x TaԻMc`'p$&-V%#MMHk+J1 N:S)}U2Qa2ؒZ䮴 L!-v_pr=qW ЦY9pDJ'х+̜ '/܈s "ץ2ּѺ³,?yXe]MŘqp zwuƓ[޷G0ԧMP -fڂ%F|L,݂jbss"h%lM/f5E!ӵjXsQT 2X.`-6m– bhF4M rОc+#.8O0R Fٵf1 *s~" źt"@v}7]`AĞ;poIdقIGZy^Cxg@klq9.l52WsۦVEݩ p72{ l@Vwf, /#&9Ы:ӪBNE!tcE$|pwUJrbۈJ_9_ac/ecRk~X~>拢PgFJF٣Q`i9hygϖ)z_{R lpTReKE9DISq0x?OLDf%E {b.gh^0/5_ulTjY-( #XV,l;k,#upLT\c-.??n8 X1oʇ!̼Q=s28}GW:Da_J?) [n}LXsX)1i4g;:5^8Ö9 D1]~QP)/%5]~v!q1˚#-(zֿ;K:foWy|ael;~Qx3;m3'P2Ϥ74(7!nsi../!?g-?DG@`Ha}Ci80bObu~)!R y%uNO!(KA,a =AvMKqp*Vܰh9K,*L̫wYl#z e(ǣp%,Ưs`ǂ8 z kvhkhm*zU8 `/5*俺C}gx$C.7CQn.C :\>m3j .dQw61#[(|( ejҾ|:.(B=ey/msN{зʍro.0B 8("_1a0Bؗv^l^d~0Gw&uh<8O_=jݬ|ş *)G,@ѩك & mZ=b):m&=SYDŽ:QuT17iARxىGȂ[ ͥfDkӹpP4ʜt> eP$;aa52AeRbkRe >9"7d OӦOY+PQ-)vV4̾>-Uj!svI|L-#\- UdOxMFXв"[*u Lnݘ{` =7h~X߼JKGQV@E1y 5H>Z4fQGOs[޵mzJ]hU(3z;Iz7h8,V% yH Dȟ;bG 1UYEHuS< 7ۡͭ}$.OnDQ)I9+d* VݟYVT`G\:B Qu+|xr[Pf;_O84 9)Ϗ1ׅsdx!9{ŨO~w[yϑ^a3_E^Qa\U3&?0 jH )G;VoDaW"&Z6W;8FTe 8]zHPA (G+3!";x}/ZBKQ&Jm*}L+#UWp/bO 92lf J̥Ed9=,M;z2Mz^Q7k`ȩxOμ+f՛i"ROZ\_ݐYam "ּ0scCyvͮtc=/.M&* c7#`f{ݰ0WŅ[Rj@W| ϛyG!'৩ϳH8W5N(fyoK YSOp>[.DY1&7nwǮQcaO\}a9ڷWW4(V7$fW';0KbI#PWDY{ͪ{۾m ?'u:SŪodً#i'#ocjkT1z2)'2 4pzuj>l =@a]V#x^WQۏTAGTGҵa<>BDyXf rz;ffg8dY+A(2cūmh'>H`f^