freeradius-server-3.0.15-9.1<>, t\/=„`zom7=%"*UG Kcb1NMArit*fh!,A]D:,ᓼD#Y3U+"}}i C-| lމ.6FL!{?UQ0B]A)C:}:pbR/LVC:aIh[Ҳa/T/ɅG/X= s|zײcy9dVո rf`̑MBI6J}uP%8I9v>K?d  -@DLPcl  ,/x  " * d j|r|Ch=1114@l(o8x<9h<:<=p>p?p@pBpFqGqHy,IDXL=Y@=Z[\]^I)bc=defluvFwxy\zCfreeradius-server3.0.159.1RADIUS ServerRemote Authentication Dial-In User Service (RADIUS) is a networking protocol that provides centralized Authentication, Authorization, and Accounting (AAA or Triple A) management for users who connect and use a network service. FreeRADIUS is a modular RADIUS implementation.\lamb66/openSUSE Leap 42.3openSUSEGPL-2.0-only AND LGPL-2.1-onlyhttp://bugs.opensuse.orgProductivity/Networking/Radius/Servershttp://www.freeradius.org/linuxx86_64getent group radiusd >/dev/null || /usr/sbin/groupadd -r radiusd getent passwd radiusd >/dev/null || /usr/sbin/useradd -r -g radiusd \ -s /bin/false -c "Radius daemon" -d /var/lib/radiusd \ radiusd # boo#912714: add radiusd to winbind group for ntlm_auth # add winbind group and fail silently if it already exists /usr/bin/getent group winbind >/dev/null \ || /usr/sbin/groupadd -r winbind # add radiusd to winbind group /usr/bin/gpasswd -a radiusd winbind test -n "$FIRST_ARG" || FIRST_ARG="$1" # disable migration if initial install under systemd [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$FIRST_ARG" -eq 1 ]; then for service in radiusd.service ; do sysv_service="${service%.*}" touch "/var/lib/systemd/migrated/$sysv_service" || : done else for service in radiusd.service ; do # The tag file might have been left by a preceding # update (see bsc#1059627) rm -f "/run/rpm-freeradius-server-update-$service-new-in-upgrade" if [ ! -e "/usr/lib/systemd/system/$service" ]; then touch "/run/rpm-freeradius-server-update-$service-new-in-upgrade" fi done for service in radiusd.service ; do sysv_service="${service%.*}" if [ -e /var/lib/systemd/migrated/$sysv_service ]; then continue fi if [ ! -x /usr/sbin/systemd-sysv-convert ]; then continue fi /usr/sbin/systemd-sysv-convert --save $sysv_service || : done fi test -n "$FIRST_ARG" || FIRST_ARG="$1" [ -d /var/lib/systemd/migrated ] || mkdir -p /var/lib/systemd/migrated || : if [ "$YAST_IS_RUNNING" != "instsys" -a -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi if [ "$FIRST_ARG" -eq 1 ]; then if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl preset radiusd.service || : fi elif [ "$FIRST_ARG" -gt 1 ]; then for service in radiusd.service ; do if [ ! -e "/run/rpm-freeradius-server-update-$service-new-in-upgrade" ]; then continue fi rm -f "/run/rpm-freeradius-server-update-$service-new-in-upgrade" if [ ! -x /usr/bin/systemctl ]; then continue fi /usr/bin/systemctl preset "$service" || : done for service in radiusd.service ; do sysv_service=${service%.*} if [ -e /var/lib/systemd/migrated/$sysv_service ]; then continue fi if [ ! -x /usr/sbin/systemd-sysv-convert ]; then continue fi /usr/sbin/systemd-sysv-convert --apply $sysv_service || : touch /var/lib/systemd/migrated/$sysv_service || : done fi systemd-tmpfiles --create /usr/lib/tmpfiles.d/radiusd.conf test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -eq 0 -a -x /usr/bin/systemctl ]; then # Package removal, not upgrade /usr/bin/systemctl --no-reload disable radiusd.service || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_STOP_ON_REMOVAL" && . /etc/sysconfig/services test "$DISABLE_STOP_ON_REMOVAL" = yes -o \ "$DISABLE_STOP_ON_REMOVAL" = 1 && exit 0 /usr/bin/systemctl stop radiusd.service ) || : fi test -n "$FIRST_ARG" || FIRST_ARG="$1" if [ "$FIRST_ARG" -ge 1 ]; then # Package upgrade, not uninstall if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : ( test "$YAST_IS_RUNNING" = instsys && exit 0 test -f /etc/sysconfig/services -a \ -z "$DISABLE_RESTART_ON_UPDATE" && . /etc/sysconfig/services test "$DISABLE_RESTART_ON_UPDATE" = yes -o \ "$DISABLE_RESTART_ON_UPDATE" = 1 && exit 0 /usr/bin/systemctl try-restart radiusd.service ) || : fi else # package uninstall for service in radiusd.service ; do sysv_service="${service%.*}" rm -f "/var/lib/systemd/migrated/$sysv_service" || : done if [ -x /usr/bin/systemctl ]; then /usr/bin/systemctl daemon-reload || : fi fiQGZ Oe4 e! hB  NoF<f_6jTd"004+{ L' 8!h w t! +_ 6+klfD [ #wWb!4 E(#+ni!_D<O6 F m$N  6/On4=m  !X&0I`I)H9JJX9)ZH)X)Jh99x) )Y08J{p90)k9)89JH99()jI9J:0)x))HI(9IR)h:)X(9I*ZPAD0" *&*%nwyD 3.~n!'O\ !w@.UD"shL& :+'|;Q[A3QE.1n/yC"iWR(U $2 (m{$aERK78d  ({\M#I 38wfs!Ol+ Y  y< /|MN hAcz <Uq~F|,t )٤f uC ` = YNKadam.majer@suse.dejbrielmaier@suse.comadam.majer@suse.devarkoly@suse.comadam.majer@suse.deadam.majer@suse.demichael@stroeder.comkukuk@suse.deadam.majer@suse.dejengelh@inai.deadam.majer@suse.demichael@stroeder.comadam.majer@suse.demichael@stroeder.comjkeil@suse.demichael@stroeder.comjkeil@suse.dejkeil@suse.dejkeil@suse.demichael@stroeder.comvcizek@suse.commichael@stroeder.comtchvatal@suse.comvcizek@suse.comdimstar@opensuse.orgvcizek@suse.commeissner@suse.comsfalken@opensuse.orgvcizek@suse.comvcizek@suse.comvcizek@suse.comvcizek@suse.comvcizek@suse.commardnh@gmx.devcizek@suse.comvcizek@suse.commls@suse.devcizek@suse.comvcizek@suse.comvcizek@suse.comvcizek@suse.comjoop.boonen@opensuse.orgvcizek@suse.comvcizek@suse.compuzel@novell.comcrrodriguez@opensuse.orgpuzel@novell.compgajdos@suse.czpuzel@novell.compuzel@novell.compuzel@novell.compuzel@novell.compuzel@novell.compuzel@novell.compuzel@novell.compuzel@novell.comcoolo@novell.compuzel@suse.czcrrodriguez@suse.de- CVE-2019-11235.patch: fixes authentication bypass vulnerability in the EAP-PWD module via invalid curve attack or a reflection attack vector. (CVE-2019-11235, CVE-2019-11234, bsc#1132549, bsc#1132664)- install license as %license instead of documentation- password-log.patch: stop logging invalid password attempts gh#freeradius/freeradius-server#2064 (bsc#1099802)- Fix permissions of radiusd.service (bnc#1053654)- bsc#1055679 - freeradius-server does not provide winbind/AD auth Added libwbclient-devel as buildrequires- update to 3.0.15 (bnc#1049086) Feature improvements * Update dictionary.starent, dictionary.ruckus Bug fixes * Bind the lifetime of program name and python path to the module * FR-GV-201: Check input / output length in make_secret(). (CVE-2017-10978) * FR-GV-206: Fix read overflow when decoding DHCP option 63 (CVE-2017-10983) * FR-GV-301: Fix write overflow in data2vp_wimax() (CVE-2017-10984) * FR-GV-302: Fix infinite loop and memory exhaustion with 'concat' attributes (CVE-2017-10985) * FR-GV-303: Fix infinite read in dhcp_attr2vp() (CVE-2017-10986) * FR-GV-304: Fix buffer over-read in fr_dhcp_decode_suboptions() (CVE-2017-10987) * FR-GV-305: Decode 'signed' attributes correctly. (CVE-2017-10988) * FR-AD-001: use strncmp() instead of memcmp() for bounded data * Print messages when we see deprecated configuration items * Show reasons why we couldn't parse a certificate expiry time * Be more accepting about truncated ASN1 times. * Fix OpenSSL API issue which could leak small amounts of memory. * For Access-Reject, call rad_authlog() after running the post-auth section, just like for Access-Accept. * Don't crash when reading corrupted data from session resumption cache. * Parse port in dhcpclient. * Don't leak memory for OpenSSL. * Portability fixes taken from OpenBSD port collection. * run rad_authlog after post-auth for Access-Reject. * Don't process VMPS packets twice. * Fix attribute truncation in rlm_perl * Fix bug when processing huntgroups. - a1eccee1.patch: FR-AD-002 - Bind the lifetime of program name and python path to the module - 62f7d288.patch: FR-AD-003 - Pass correct statement length into sqlite3_prepare[_v2]- update to 3.0.14 (still FATE#322416) Feature improvements * Enforce TLS client certificate expiration on session resumption, and Session-Timeout. See CVE-2017-9148 (bnc#1041445) * Updated dictionary.cisco.vpn3000, dictionary.patton * Added dictionary.dellemc * Lowered the log output for failed PEAP sessions. * ALlow utc in rlm_date. * The internal OpenSSL session cache has been disabled. Please see mods-available/eap * Update detail reader documentation. * Make outgoing RadSec connections non-blocking. * Add SQL backing to Moonshot-*-TargetedId generation. Bug Fixes * radtest uses Cleartext-Password for EAP, not User-Password. * Update documentation for mods-enabled/ linking. * Enhanced checks for moonshot salt. * Allow session resumption for RadSec connections. * Update "huntgroups" file to note that port ranges are not supported * Fix OpenSSL permissions issues on default key files. * Certificates are not required when PSK is used. * Allow SubjectAltName as first extension in cert. * Fixed talloc issue with TLS session resumption. * "&Attr-26 := 0x01" now produces useful error messages. * Handle connection error in rlm_ldap_cacheable_groupobj. * Fix endian issues in DHCP. * Multiple minor fixes for Coverity complaints. * Handle unexpected regex. * Fix minor issues in dictionaries. * Fix typos and grammar. Patches from Alan Buxey. * Fix erroneous VP creation in rlm_preproces. * Fix MIB. Patch from Jeff Gehlbach. * Trust router updates from Alejandro Perez. * Allow build with LibreSSL. * Use correct packet for channel bindings. * Many fixes found by PVS-Studio. Thanks to PVS-Studio for giving us a test license. Please see the git commit history for more info. * Fix incorrect length check in EAP-PWD. This may be exploitable. * Stop rotating session database files (radutmp, radwtmp) since these are not logfiles. - freeradius-server-radiusd-logrotate.patch: updated- removed obsolete freeradius-server-fix-cert-bootstrap.patch because recent /etc/raddb/certs/bootstrap simply works - update to 3.0.13 (still FATE#322416) Feature improvements * Add dictionary.rfc7930. Note that we do not implement the RFC. * Added 'cipher_server_preference' to mods-available/eap Patch from #1797. * OpenSSL 1.1.0 compatibility fixes. * rlm_perl: radiusd::xlat to evaluate xlat string within perl script * Allow authentication retry in winbind. Patch from Herwin Weststrate. See raddb/mods-available/mschap. * Added "recv-coa" method to rlm_rest. It behaves the same as "authorize". * Document Trust Router tr_port option. Patch from Stefan Paetow. * Update elasticsearch/logstash examples so that they work with elastic stack v5. Patch from Matthew Newton. * Print information about packets, replies, and contents in the detail file reader. * Update abfab-tr policy. Pull request #1893 from Stefan Paetow. * Reject packets which contain User-Password and EAP-Message. * Add example for filtering Access-Challenge. See sites-enabled/default. * Pull symlink fixes from v4.0.x. Fixes #1859. * Add systemd reload. Not everything is reloaded, but some is. Fixes #1662. * Better documentation for listen "ipaddr". Fixes #1921 * Add dictionary.cnergee, updated dictionary.nomadix. * radclient no longer needs -x to print statistics with -s. Bug fixes * Minor typos. Fixes #1763 * Fix typo in RPM build. Closes #1767. * rlm_mschap check for password expiry only if password was correct. Fixes #1762. * Update debian build. * update rlm_counter "man" page. Fixes #1775. * Remove erroneous assert. Fixes #1778. * fix mschap password change test. Fixes #1792. * Cleanup config file on data remove. Fixes #1795. * passwd module returns "notfound" if not found. * Check for old OpenSSL, and don't build rlm_eap_fast if it necessary. Fixes #1803 * Cleanup memory better after ldap version query. Patch from Aleksey Katargin. * Rename lt_* functions to avoid linker issues with libtool. Fixes #1277 * Many miscellaneous fixes and typos. * Allow long strings in %{%{foo} bar:-%{baz} blah". Fixes #1866 * Fix filtering operators, along with more documentation and more tests for them. * Fix OpenSSL fixes. Fixes #1876. * Finish SQL select queries even when SELECT returns no rows. Fixes #1879. * Set Module-Failure-Message for more EAP errors. * Correct typo in dictionary.rfc5580. Fixes #1882 * Remove obselete systemd syslog.target. * Client-Port-Balance load-balancing now uses client port. * Radrelay examples fixed from Alex Clouter. * Update systemd target. Pull request #1896. * Trim starting whitespace in xlat strings. * Get MySQL result lengths using normal API. * suid down after fchown(). Fixes #1914. * Fix cases of comparing pointer to NUL character. Fixes #1915. * OpenSSL v1.1 fixes. Pull request #1921. * Better Handle v4/v6 host names. Pull request #1919. * Remove "Auth-Type = System" from docs and examples. * Don't crash on malformed %{home_server}. Fixes #1922 * fix erroneous use of talloc destructor in rlm_eap * Issue trigger modules.sql.fail. Fixes #1923 * Document python_path gotcha's. Fixes #1845 * dlopen() the specific version of Python. Fixes #1592- Don't require insserv if we use systemd - Remove require for unused fillup- Merge changes from SLE to openSUSE (FATE#322416): * freeradius-server-radclient-init-error-buffer.patch - make sure we initialize error buffer. bsc#911886: radclient error free() invalid pointer * freeradius-server-opensslversion.patch: remove OpenSSL version check and assume we know what we are doing. (bnc#1013311) * merge .changes file, mostly. - do not attempt to detect "vulnerable" OpenSSL versions. SUSE security fixes do not necessarily bump version numbers as does upstream OpenSSL (bnc#1021375) - do not generate certificates in %post. End-user needs to do this manually. - keep FreeTDS disabled on SLE12 - we never shipped it enabled - require OpenSSL 1.0+ - use pkgconfig(systemd) instead of plain systemd as BuildRequires - don't list manual pages as %doc- Remove --with-pic which is for static libs only. - Use SUSE RPM group names. Trim filler words from description. - Do not hide errors from groupadd/useradd.- Add upstream keyring - 2 new modules: rlm_sql_freetds and rlm_eap_fast- update to 3.0.12 - still fate#320481 The focus of this release is stability. * Feature improvements + Add support for =~ and !~ in update sections. See "man unlang" + Add dictionary.checkpoint. + Simultaneous-Use prints out more information. + Print WARNING in debug mode when packets may be truncated. + Added expansions %{home_server:state} and %{home_server_pool:state}, which show the state of the server / pool. + Mark rlm_sql_freetds as stable. + Make rlm_perl less fragile. Patch from Herwin Weststrate. + Allow extended attributes to have "encrypt=2" + Update dictionary.aruba. + Add support for EAP-FAST. This is an isolated feature which does not affect anything else. + Update OpenSSL vulnerability list. Use a version of OpenSSL released after September 20, 2016. + EAP certificate verification is now done when "verify" is enabled and "ocsp" is disabled. + New dhcpclient and rlm_rad_counter man pages. + Minor abfab and moonshot additions. + Pass CFLAGS through from environment in RPM builds. Allows more custom builds. + Build with Heimdal in addtion to libkrb5. * Bug Fixes + Use correct typedef for older versions of sqlite. + Update mssql schema to add priority + don't complain on /dev/urandom in ldap + fix == operator in update sections + Don't create DHCP strings with many trailing zeros. + Allow MS-CHAP change passwords instead of complaining on large buffer. + Allow assignment or equality operator on SQL. + Update aclocal tests for FreeBSD 10. + Remove occasional hang in rlm_linelog. + Copy VSAs to inner tunnel for TTLS and PEAP. Fixes #1544 + A few minor bugfixes caught in v3.1.x cleanup, and back-ported to v3.0.x. + do_not_respond again works in post-proxy + Allow realm "~^.*$" {} and User-Name with no realm. + Fix leak when creating unknown attributes + Fix Debian / logrotate. + Make OpenSSL error functions thread-safe. + Fix crash with rlm_sql and updating SQL-User-Name. + Debian build updates. + Allow regular expression comparisons in radclient. + Fix memory leak on unknown attributes in detail file reader. + Update example paths in "man" pages when installing them + Build fixes for rlm_mschap. Fixes #1489. + BSD build fixes. Patch from issue #1583. + Be more careful about /lib/ when building. Fixes #1585. + Correct ifdef placement error. Fixes #1572. + Allow for more files in internal "exfile" API So it will be possible to open more than 64 "detail" files at the same time. + Remove support for statically built EAP modules. Fixes #1591. + Many fixes to rlm_python from Guillaume Pannatier. + Use correct week adjustment in SQLcounter. Fixes #1608 + Minor fixes to allow compilation without DHCP, VMPS, or TCP. + Fix checks for module / config file change on HUP. + Compile regex comparisons when sent via "debug condition". + Update filenames in documentation and examples. + Don't crash if SQL connection becomes unavailable. + Disallow originate_coa when proxy_requests = no. + Free rad_perlconf_hv in correct perl context. + Multiple fixes for Debian builds. #1510, among others. + Set OpenSSL FIPS compatibility flag when necessary. + Pulled fixes for the build system over from other branches. + Fix OCSP for RADIUS over TLS. + Fix skip_if_ocsp_ok behavior. + Better fixes for systems without closefrom() but which have /proc. + Minor build fixes back-ported from v4.0.x. + build --whout-ascend-binary. Fixes #1761. + Be more aggressive about not opening new connections in debug mode after CTRL-C. Address #1604.- use %{with} macro for conditional inclusions instead of hardcoding version numbers - improved package descriptions - fixed builds on SLE12 and SLE11SP4- removed installation of experimental module rlm_sqlhpwippool.so - update to 3.0.11 (fate#320481, bsc#961479, CVE-2015-8763, bsc#935573, CVE-2015-4680) * Changes of version 3.0.11 + Feature improvements - "unlang" comparisons of IP addresses to IP prefixes are now detected, and types automatically cast. - Allow shorthand form of ipv4prefix values e.g. 127/8. - Add "auto_chain" to raddb/mods-available/eap, tls subsection. This allows the disabling of OpenSSL auto-chaining of certificates. Which might be wrong. - Added printing of coa and disconnect stats (radmin). - radclient defaults to expecting Access-Accept responses to Status-Server. - Updated dictionary.lancom, dictionary.starent. - Portability fixes for Solaris. - More errors from ntlm_auth gets passed to MS-CHAP. - Update abfab-tr-idp virtual server. - Added "filter_password" in policy.d/filter. This removes embedded zero bytes in User-Password, for compatibility with broken clients. - The server now issues a WARNING message if duplicate configuration items are found. - TLS can skip the "verify" section if OCSP returns OK. See raddb/mods-available/eap, "skip_if_ocsp_ok". - Set TLS-OCSP-Cert-Valid = yes / no / skipped, which is the result from the OCSP check. - Interoperate with AD and "LmCompatibiltyLevel = 5", by always setting WBC_MSV1_0_ALLOW_MSVCHAPV2 for native winbind in rlm_mschap. - TTLS and PEAP now require "virtual_server" to be a real server. - Print WARNING when TTLS or PEAP identities are spoofed or not properly anonymized. See RFC 7542 for requirements. - Various rlm_python fixes from Herwin Weststrate. - Allow setting Response-Packet-Type in "Post-Proxy-Type Fail", which is useful when the home server does not respond. - elasticsearch updates from Matthew Newton + Bug Fixes - Fix issue where field nas_type would not be accessible via the %{client:} xlat, for clients loaded from SQL. - Fix compatiblity issues with OpenSSL 1.0.2. Ignore calls to msg_callback with 'pseudo' content types. - Data type "ipv4prefix" is parsed correctly. - Use correct talloc context in rlm_exec. Fixes #1338. - Complain in unlang if "else" is used with no previous "if" or "elsif". - Send accounting status packets to the accounting port. Fixes #1364. - Print out CFLAGS when doing "radiusd -Xxv" - Fixed bug with coa/acct stats value #1339. Based on patch from Jorge Pereira. - Fixes for LEAP proxying. Don't use LEAP! - Fix issue with "directory already exists" seen when doing "make install". - Fixed bug with radmin related to the option "stats detail " - Complain if the detail file reader does not have permission to read the "detail.work" file. Fixes #1398 - Fixed SoH. Attributes were not being copied to the virtual server. - Used a wrong list to global statistics in "stats". - Create EAP-PWD identity correctly. Prevents segfaults. - Dynamically validate authentication types for PEAP and EAP-MSCHAPv2. - Fix includes in installed headers. - OpenSSL 1.0.1f and 1.0.1g do NOT calculate TLS 1.2 keys correctly. See raddb/mods-available/eap, "disable_tlsv1_2" - Allow password change to work for MS-CHAP. This requires 'r=0', because password changes are not retries. - Fix home server fail-over for home servers using TCP and/or RadSec. - Special characters in expanded regexes are now escaped e.g. User-Name containing '.', and comparing /%{User-Name}/, the '.' will now be escaped. See src/tests/keywords/regex-escape. - Use correct authentication vector when sending Access-Reject replies for RadSec. - Set FreeRADIUS-Proxied-To in TTLS again. You should use the "inner-tunnel" virtual server, instead of relying on this attribute. - Fix debugging constants in rlm_perl. Patch from Herwin Weststrate. - Add samba-dev / samba4-dev to debian builds so that rlm_mschap can automatically use the new winbind API. - Automatically skip zero-length attributes when sending packets, instead of erroring out.- fix bsc#951404 * Rebuild of freeradius-server package fails * fix source url - ftp://ftp.freeradius.org/pub/freeradius/ + ftp://ftp.freeradius.org/pub/freeradius/old/- update to 3.0.10 * Changes of version 3.0.10 + Feature improvements - Do more optimization of unlang policies. This makes run-time a bit faster. - Re-name most of the functions in src/lib. Third-party module authors will have to do the same. - More documentation on contributing and how to write modules. - Update radiusd.service for systemd. - Open IPv6 proxy socket if the server is listening on IPV6 auth / acct / coa packets. - Create debian packages for DHCP. Fixes #1125. - Add more tests for "update" section parsing. - Update "man" pages. - Update attributes for Alcatel 7750 - Add dictionary for Boingo Wi-Fi - Add support for DHCP lease queries. See raddb/sites-available/dhcp - On HUP, check all modules for config files which have changed. And only re-load those modules. - Allow FreeRADIUS-Response-Delay(-USec) to be set for RADIUS packets. Patch from Herwin Weststrate. - Documentation fixes from Alan Buxey and Matthew Newton. - Update "logrotate" script. - Added more RFCs to doc/rfc for new standards implemented by FreeRADIUS. - Don't crash when doing "radmin -e "help hup". Patch from Matthew Newton. - The dictionary parser now does more sanity checks, which prevents run-time problems with invalid attributes. - Update debian packages. Patches from Christopher Hoskin. - Many other debian packaging fixes from Matthew Netwon and Herwin Weststrate. - Add "session-state" to Perl. Patch from Herwin Weststrate. + Bug Fixes - Fix rlm_files so that there are no collisions when loading 10's of 1000's of users. - Fix radclient to use our internal v4/v6 parsing functions. v6 addresses with ports now work correctly. - Fix sending/receiving packet messages to wrap v6 addresses in square brackets '[]'. - Check for sasl/sasl.h when building rlm_ldap, and disable SASL functionality if unavailable. - Fix issue which caused a non \0 terminated buffer to be assigned to attributes if the value being assigned contained an invalid escape sequence. - Fix deadlock when reconnecting connections in the connection pool. - Fix potential overrun in functions that used fr_utf8_char with a non nul terminated buffer. - Fix decoding issue for Tunnel-Password type attributes which were very long. Found by Denis Andzakovic. - Fix radclient issue with TCP sockets on FreeBSD. - The server now creates ${run_dir} and ${logdir} directories in daemon mode, when running as "root". - Handle tags when using maps. Fixes #1191. - Fix crash when CoA packets time out. - Fix parse error in rediswho - Fix regex support in SQL radcheck the "users" file and radsniff. - Register listen xlat earlier, so that it's available when the virtual servers are being parsed. - Parse Ascend-Data-Filter when given as "0x..." - Print Ascend-Data-Filter correctly. Add test cases for both. - Allow old-style clients again. They will be disallowed for 3.1.0 and following. - Complain instead of crash when "else" and "elsif" are in the wrong place. - Clean up memory more aggressively. This lowers the maximum memory used, most typically for TLS based EAP methods. - Prevent the server from unlinking the control socket of an already running instance. - Fallback to using the configured OCSP URL if one exists, and no URL is provided in the certificate. - Return CoA-NAK if proxying CoA fails. Based on patch from Jorge Pereira. - Lower peak memory usage by decreasing size of internal memory pools. - The control socket is now left in place if a second copy of the server is accidentally started. - Allow virtual attributes in "switch", "case", etc. Fixes [#1240] and #1265. - Many spell check / typo fixes in comments and example configuration files. - Better handle multiple DHCP listeners. - Don't print secrets for old-style realms. Fixes #1267. - Don't fall through in empty "case" statements. Fixes #1274. - Update EAP-TTLS so that MPPE keys are correctly calculated with TLSv1.2. - Always delete MS-MPPE-* from the TTLS inner tunnel. This allows TTLS / EAP-MSCHAPv2 to work. Fixes #1206. - Fix off by one error that caused some MSCHAP-Error messages to be sent without the password change version (V=3) and the textual message component (M=). - Always include C= V= and M= in MSCHAPv2 errors. RFC 2759 does not say that any of these fields are optional, and not including V= caused errors with wpa_supplicant. - Do not include M= in MSCHAPv1 errors. It's not supported.- Fix boo#912714: freeradius can't use ntlm_auth * Create winbind group * Add radiusd to winbind group- Remove gpg signature file * The gpg signature checking is broken and doesn't work- Fix bsc#935573: Insufficent CRL application for intermediate certificates * CVE-2015-4680 * freeradius-server-CVE-2015-4680.patch based on https://github.com/FreeRADIUS/freeradius-server/commit/a03814af310bb3bee74ea012546d99c48b0ea5c3- update to 3.0.9 * Changes of version 3.0.9 + Feature improvements - Make "pool" configurations more consistent, and update documentation for them. - Move connection pool logic to "most recently started", instead of MRU. This should help with pool stability. - More VSAs for 3GPP2 - Added examples of multi-value attributes to rlm_perl. - LDAP-Group and SQL-Group attributes are now dynamically allocated. - Only the "sql" module registers SQL-Group. Other instances register "instance-name-SQL-Group", similarly to "ldap". - Unknown attributes are now complained about more often when used in unlang statements. e.g. if (Foo-Bar == 3) used to be a string to string comparison. It is now a parse error. - Rename RLM_COMPONENT_* to MOD_* in the code. This makes many things easier. - Move to C99 initializers for modules. - Load modules in raddb/mods-enabled. This allows attributes like "LDAP-Group" to be used in the "files" module, without explicit ordering or listing in "instantiate". - Added 'bootstrap' section to modules. Third-party modules will need to be updated. - When adding clients from a DB, add them to a virtual server if that virtual server has a "listen" section. Otherwise, add the clients to the global list. - When reading dynamic clients from a file, don't expire them if the underlying file is unchanged. - Allow the server to originate CoA requests from the post-auth stage. - The server creates ${run_dir} and ${logdir} in daemon mode, if they do not already exist. - Add dictionary for Wi-Fi Alliance Hotspot 2.0. The server now supports all mandatory and optional attributes for this specification. - HUP now re-loads the configuration only if the files have changed. If all files are unchanged, HUP re-opens the log file, and does nothing else. - Much better debug messages for EAP-TLS, including which attributes are cached, and when they are retrieved. - Increase default max_requests to 16384. Memory is cheap now. - Added "stats memory" commands to radmin. Debug build only. - Aptilo controller dictionary updates. - SQL modules now use Acct-Unique-Session-Id everywhere. - The redis modules are now stable. - The LDAP module now supports SASL "interactive bind" method. This allows Kerberos based administrator and user binds. - DHCP code is now in libfreeradius-dhcp. - More DHCP encoding / decoding unit tests. - rlm_replicate can now be listed in the "accounting" section. - Better sqlite debugging output. - Remove "required" option from many sql_ippool directives. - Set default CA "basic constraints" to "critical". Fixes #1073 - Updates to help / man pages from Jorge Pereira. - Added more tests. + Bug Fixes - Be more careful about unused config item warnings when using -Xx. - Move more defines to be auto-generated. - Allow virtual servers in proxy fallback. - Allow %{module:} to work. - Don't crash in RadSec. Closes #980. - Return better errors when a unix group / user is not found. - Re-enable detail module "locking" parameter. - Don't crash when logging replies from Status-Server packets. - The couchbase module now uses "update" instead of "map", for consistent with the rest of the server. See raddb/mods-available/couchbase - Don't require NT-Password for MS-CHAP password changes. - Be a bit more careful about decrypting MS-CHAP-MPPE-Key attributes. Closes #1013. There is no perfect fix, tho. - Fix security issues with EAP-PWD. See http://freeradius.org/security.html#eap-pwd-2015 - Fix dynamic clients read from SQL in non-debug mode - MS-CHAP now allows retries (i.e. password change) when passwords are expired. - Allow "user=radiusd" when the server is already user "radiusd" - suid up/down works on non-Linux systems. This means that the control socket should have the correct ownership. - Fix issue which caused the server to sometimes have problems when a home server was marked zombie. - Fix format.pl because Perl is now more picky. - Fix proxy to Packet-Dst-IP-Address, so that it uses the correct destination port. - Fix corner case with cursor functions and removal. - OpenDirectory fixes and documentation. - Fix leaks in rlm_redis. - RFC 6929 "evs" attributes are now encoded / decoded properly. - Fix talloc pool leaks when receiving malformed or retransmitted Accounting/CoA requests. - Printed attributes again use double quotes instead of single quotes. - Set X509_V_FLAG_CRL_CHECK_ALL, and add "check_all_crl" to eap.conf. Fixes oCert CVE-2015-4680. - rlm_expr now errors out correctly on malformed attribute references instead of triggering an assert. - Make "break" work in "foreach" loops - Allow dynamic expansions to work again in the "hints" file. - Correct minor typos in comments and examples from Alan Buxy. - Re-urlencode the path portion of ldapi:// urls before passing it to ldap_initialise. - freeradius-server-rlm_sql_unixodbc-configure.patch removes hard-coded directory in configure script of rlm_sql_unixodbc - install new module rlm_sqlhpwippool.so- minor adjustments/cleanup of spec and changes- update to 3.0.8 * Changes of version 3.0.8 + Feature improvements - Allow syslog_severity to be set in rlm_linelog. - Allow defaults to be set for bulk clients in LDAP and couchbase. - Updates to dhcpclient. Patches from Nicolas C. - rlm_mschap now supports direct connections to winbind, which is faster than ntlm_auth. See raddb/mods-available/mschap. Patch from Matthew Newton. - Recommend /dev/urandom for TLS randomness, instead of ${certdir}/random - Allow TLSv1 to be disabled via "disable_tlsv1" in tls{}. - Allow Expanded EAP types where vendor is 0 (IETF) and type is normal EAP type. Supplicants sending Expanded EAP types like this are broken. - Add support for server side sort controls when searching for user objects in rlm_ldap. + Bug Fixes - Don't complain about "authorize" in "server {}" blocks, but only if there's no "server" block. - Fix cosmetic issue where debug from the first packet read by a detail reader thread would be emited during config parsing. - Fix ASSERT on truncated detail packets. - Don't use main server log functions from within panic_action, as in the case of syslog this would cause deadlocks if the fault was triggered from within a malloc. - Fix issue in "switch" when "correct_escapes = false". Fixes #911. - Fix sqlcounter configuration to use "%%b" instead of "%b", otherwise the new syntax validation will fail. - Allow forward references in configuration items. Modules aren't always loaded in a sane order. - Fix more escaping issues. Closes #912. - Decode MAC addresses correctly for VMPS. - Fix memory leak with TLS connections. - Fix state machine threading issues for conflicting packets. - Fix copy_request_to_tunnel issues for tagged attributes. - Allow "ok" to over-ride "updated" inside of Auth-Type sections. - Update state machine so that post-proxy is run though child threads for performance, instead of blocking the main thread. - Allow "netmask" to work again in client definitions. - Relax restrictions on SQL group queries. - track outgoing proxy sockets and clean them up more aggressively. - track proxy statistics, including CoA and Disconnect. - If radmin has a connection failure when running a command, it re-connects and runs the command again. - mark home servers "unknown" less aggressively. - Fix potential SEGV in PostgreSQL driver on error. - Fix issue where fields like nas_type would not be accessible via the %{client:} xlat, for dynamic clients. - Set default busy_timeout (of 200ms) in the sqlite driver, so writes don't cause selects to fail in multithreaded mode. This is user configurable, and may be increased if required. - Convert Password-With-Header attributes to binary (from hex or base64), in the authorize method of rlm_pap. - Fix invalid assert in state.c, that could cause abort in post-auth. - Fix double free when -m flag is used, and connection pools are referenced by multiple modules. - RADIUS over TLS accounting uses the same port as authentication. - Regularized return codes from radmin commands. - Fix RHEL spec file so it works correctly for Centos7 which uses systemd, and didn't like the SystemV init script. - radwho and radlast now have a -D option to load dictionaries - DHCP packets are no longer checked for duplicates. - Don't crash in sql module group comparisons in corner case. - Calculate MPPE keys correctly when using TLS 1.2. - Fix load-balance sections. Closes #945 - TLS certificates are available again in the post-auth section. They are not available for session resumption. - radclient encodes CHAP-Password properly when using -c Closes #955. - Fix issue in rlm_cache_memcached driver that caused variable length values to be truncated. - Fix track functionality in detail reader, so it no longer fails with a "Failed marking detail request as done: Bad file descriptor" error. - Actually add the peer identity (as User-Name) to the inner tunnel in EAP-PWD requests, so it's available for lookups. - Fixes to PostgreSQL queries. Patches from Santiago Gimeno. - new set of consolidated patch files: deleted: * freeradius-server-2.1.1-logrotate_su.patch * freeradius-server-2.1.6-rcradiusd.patch * freeradius-server-initscript-pidfile.patch * freeradius-server-radius-reload-logrotate.patch * freeradius-server-var_run.patch added: * freeradius-server-radiusd-logrotate.patch * freeradius-server-rcradiusd.patch * freeradius-server-tmpfiles.patch- Do not disable as-needed build - Remove the with_sysconfig switch and just stick with versions- update to 3.0.6 - fixes a segmentation fault in PEAP module (bnc#912588) Feature improvements: * radmin / raddebug conditional errors are printed to the output, instead of being discarded. * raddebug will exit if condition set with -c was invalid. * radmin auto-reconnects if the connection to the server has gone away. * rlm_cache now has submodule support. See raddb/mods-available/cache * New memcached driver for rlm_cache. See raddb/mods-available/cache * Add support for &Attribute-Name[*] in conditions. See "man unlang" for details. * Add &Attribute-Name[n] which gets the last instance of an attribute e.g. Module-Failure-Message[n]. * Allow for redundant string expansions. See the "instantiate" section of radiusd.conf. * When checking IP addresses in conditions, make the right side be parsed as an IP prefix. * Support JIT compilation of compiled regular expressions when built with libpcre. * Support named capture groups with "%{regex:}" when built with libpcre. * Increase regular expression capture groups from 8 to 32. * Emit error markers for badly formed regular expressions. * Allow 'm' flag to enable multiline mode in regular expressions. * Support limited implicit attribute conversion in update sections. * Support casting between IPv6 and IPv4 where the IPv6 address has the v4/v6 mapping prefix (::ffff:).- Drop .keyring and .sig file: freeradius-server still uses MD5 signatures, which are no longer validated/accepted by GPG 2.1.- update to 3.0.5 Some of the new features: * Allow LDAP to specify arbitrary attributes for dynamic clients. * Allow one level of backslashes (finally). See radiusd.conf, "correct_escapes" setting. * When supported by OpenSSL, allow TLS 1.1 and TLS 1.2 in EAP methods. * Allow multiple new connections to be spawned simultaneously in the connection pool, to cope with spikes in traffic. * Use kqueue on systems which support it. This allows for better scaling when using many sockets. * Home server "response_window" can now take fractions of a second. See proxy.conf. * radmin now supports "show module status", as thee counterpart to "set module status" * "ipaddr" will now use v6 if no v4 address is present. You should use "ipv4addr" or "ipv6addr" to force v4/v6 addresses. * "client" sections will allow "ipaddr = 192.192.0/24". The old "netmask" is still accepted, but the new format is preferred. * Allow custom HTTP headers to be set for rlm_rest requests using control:REST-HTTP-Header (attributes consumed after use). * Extend format of %{rest:} expansion to allow HTTP method and POST data to be specified and urlquoting. * Add support for aliases in rlm_ldap. * Add support for connection pool sharing to all modules that use the connection pool (pool = ). * "tls" sections now have a "psk_query" configuration item, for dynamic queries to discover a key from a PSK identity. * Preliminary support for EAP channel bindings. * Foundational work for dynamic home servers. They do not yet work, but this is now only a matter of updating the "realm" module in a future release. * Support &attr[*] syntax to copy all instances of an attribute when used with the += operator in an update section. May be qualified with a tag. * The logintime and expiration modules can now be listed in the post-auth section. This makes some configurations simpler. * rlm_sqlippool is now IPV6 capable. Set "ipv6 = yes" to get Framed-IPv6-Prefix returned. The SQL queries have NOT been updated. Please submit patches. and numerous; bugfixes - remove gpg-offline - create /run/radiusd after install - drop freeradius-server-opensslversion.patch (upstream)- freeradius-server-opensslversion.patch: do not check the minor version of openssl, minor versions are supposed to be compatible. bnc#906682- added patch to changelog to fix factory-auto failure (Req #242825) added: freeradius-server-var_run.patch- fixed SUSE spelling in a filename (bnc#889034) * don't install suse/README.SuSE - remove old tarball and signature file- spec run through spec-cleaner - don't install files to /var/run- update to 3.0.3 Many bugfixes Feature improvements * Everything now builds with no warnings from the C compiler, clang static analyzer, or cppcheck. * rlm_ldap now supports defining the LDAP attribute name via backticked expansion (i.e. shell command) in RADIUS <-> LDAP mappings. * rlm_ldap now supports older style generic attributes. * dynamic expansions (e.g. "%{expr:1 + 2}" are now parsed when the server starts. Syntax errors in the strings are caught, and a descriptive error is printed. * Static regular expressions (e.g. /a*b/) are now parsed when the server starts. Syntax errors in the strings are caught, and a descriptive error is printed. * dynamic expansions are cached after being parsed. They are no longer re-parsed at run-time for every request. * regular expressions are now parsed and cached when the server starts. * Added the %{rest:} expansion to rlm_rest, which will send a GET request to the URL passed as the format string. Any body text will be written to the expansion buffer. * rlm_rest now available as a debian package. * When an 'if' condition statically evaluates to true/false, unlang does more static optimization. For examples, see src/tests/keywords/if-skip * All modules are marked as safe for '-C', which lets the dynamic expansion checks work in more situations. * Added 'none' and 'custom' rlm_rest body types. 'custom' allows sending of arbitrary expanded text and content-type headers. * Added "config" section to Perl. See mods-available/perl * Added '%v' which expands to the server version - Patch from Alan Buxey. * more mis-matched casts are caught in "if" conditions, and descriptive errors are printed. * Support basic response validation in radclient. This allows administrators to write local test cases for their site-specific configurations. * Removed radconf2xml and radmin "show client config" and "show home_server config". * Forbid running with vulnerable versions of OpenSSL. See "allow_vulnerable_openssl" in the "security" subsection of "radiusd.conf" * Catch underlying "heartbleed" problem, so that nothing bad happens even when using a vulnerable version of OpenSSL. * Add locking API for sql_null, linelog, and detail modules, which should improve performance and work around issues on platforms with bad file locking. * Allow DHCP NAKs to be delayed, via setting reply:FreeRADIUS-Response-Delay = 1 * Allow tag and array references anywhere attributes are allowed in "unlang". * many enhancements to radsniff, including output to collectd, ipv6 support and packet loss statistics. * Many dictionary updates (ZTE, Brocade, Motorola). * rlm_yubikey now automatically splits passwords from OTP strings. * The detail file reader is now threaded by default. This should improve performance reading the files. - dropped freeradius-server-CVE-2014-2015.patch (upstream)- fix for CVE-2014-2015 (bnc#864576) * denial of service in rlm_pap hash processing * added freeradius-server-CVE-2014-2015.patch- remove the old 3.0.0 sources- update to 3.0.1 Feature improvements * Add "timeout" to exec, and "ntlm_auth_timeout" to mschap. So that run-away child processes are caught earlier. * Allow TLS clients to use "proto = tls", in which case TLS is required. The shared secret is then set to "radsec". * More documentation in the tls virtual server. * Add "date" module for date formatting. See raddb/mods-available/date. * Added unit test suite for internal server functionality * When loading "update" sections, check if the RHS is a literal value. If so, syntax check it immediately. * Update LDAP module documentation and functionality. The generic attribute can now update lists. * Updated dictionary.extreme. * Update sqlippool to do clears as a separate transaction, and at most once per second. This should help MySQL. * Respect control:Response-Packet-Type for all types of requests. * Add support for SSL encryption to the MySQL driver. * Allow arbitrary connection parameters to be used with the PostgreSQL driver. * Changes to the OpenLDAP schema to fully expose functionality of the new LDAP module. * Update debian packaging to include a freeradius-config package. This package may be provided as a site local package to avoid fighting with the preinstalled config files. Bug fixes * Use correct field for ARP setting in DHCP. * Fix crash on debug condition (#454). * Fix a number of minor issues caught by the clang analyzer. * Set WARNING messages to yellow instead of normal text. * Correct debug colorise logic. Patch from Phil Mayers. * Encode attributes of type "ethernet". No one uses them, but it makes sense. * Work around regex initialization issues. * Fix build when linking against OpenSSL. * Print IDs as positive numbers, which helps for large DHCP XIDs. * Fix issue with sql_ippool. * sqlcounter now uses 64-bit counters, to deal with 4G overflow. * Fix issues with DHCP subsystem. * Don't build / install disabled modules, or their config files. * Fix build for OSX Mavericks, which hid the header files in a magical place. * Fix LEAP buffer issue. You should still avoid LEAP. * Mark "unknown" WiMAX attributes as being WiMAX. * Fix typo in packet decoder for fragmented extended attrs * RPM spec fixes. * Fix rlm_perl build issues when not using threads. * Enable %{Response-Packet-Type} again. * Update configuration file parser to handle "bool" consistently. * Update declarations of global boolean variables to use "bool" consistently. This fixes an issue where some modules were instantiated in "config check" mode and did not work correctly. * Make more messages debug instead of info, to avoid polluting the logs with messages that can't be fixed. * Set operator in internal unlang code to suppress spurious warning messages. * Fix debian packaging. * Added "status" to Debian init script. * Fix "update outer.request" to update the outer request. * Don't print TLS debugging messages when not in debug mode. * Correctly manage counters for "limit" sections of TCP / TLS "listen" sockets. * Fix libldap debug output. * Fix rlm_ldap tls functionality. * Initialise OpenSSL globals early to avoid issues with the PostgreSQL library. * Fix typo in sqlcounter expansion code. Fixes #463 * Overwrite previous instances of SQL-User-Name when adding it to the request. * Work around bugs in both MIT and heimdal versions of krb5_copy_context(), which caused segfaults in multithreaded mode. * Provide meaningful error messages if Heimdal krb5 is used. * Fix attribute supression in rlm_detail. * Exit with error code if child fails to complete server initialisation after forking. This allows init scripts to correctly report whether the server started ok.- don't build with experimental modules - fix packaging bugs: * install init scripts only on <= 11.4 * install systemd unit * add %defattr for submodules- update to 3.0.0 * new feature release * see /usr/share/doc/packages/freeradius-server/ChangeLog for complete list of changes in this release * documentation for upgrading from 2.x is in /etc/raddb/README.rst - drop oracle support (wasn't built anyway) - dropped patches (obsolete): * freeradius-server-2.1.6-codecleanup.patch * freeradius-server-2.1.6-dialup_admin.patch * freeradius-server-2.1.1-edirectory.patch - added systemd service unit * radiusd.service - added systemd-tmpfile for /var/run/radiusd * freeradius-tmpfiles.conf - added gpg-offline verification * freeradius-server.keyring- add libperl_requires, as we link against libperl and thus need a specific version of perl- fixed a bug in the logrotate script (bnc#797292)- files in sites-available/ are now %config(noreplace) [bnc#781756]- update to 2.2.0 - see /usr/share/doc/packages/freeradius-server/ChangeLog for complete list of changes in this release - fixes CVE-2012-3547 (bnc#777834) - dropped freeradius-server-2.1.6-overflow.patch (upstream) - dropped freeradius-server-sha1-default.patch (upstream) - refreshed freeradius-server-fix-cert-bootstrap.patch- Use the new 'su' logrotate option (bnc#677335)- Enable the same CFLAGS as for other hardware- update to 2.1.12 Feature improvements * Updates to dictionary.erx, dictionary.siemens, dictionary.starent, dictionary.starent.vsa1, dictionary.zyxel, added dictionary.symbol * Added support for PCRE from Phil Mayers * Configurable file permission in rlm_linelog * Added "relaxed" option to rlm_attr_filter. This copies attributes if at least one match occurred. * Added documentation on dynamic clients. See raddb/modules/dynamic_clients. * Added support for elliptical curve cryptography. See ecdh_curve in raddb/eap.conf. * Added support for 802.1X MIBs in checkrad * Added support for %{rand:...}, which generates a uniformly distributed number between 0 and the number you specify. * Created "man" pages for all installed commands, and documented options for all commands. Patch from John Dennis. * Allow radsniff to decode encrypted VSAs and CoA packets. Patch from Bjorn Mork. * Always send Message-Authenticator in radtest. Patch from John Dennis. radclient continues to be more flexible. * Updated Oracle schema and queries * Added SecurID module. See src/modules/rlm_securid/README Bug fixes * Fix memory leak in rlm_detail * Fix "failed to insert event" * Allow virtual servers to be reloaded on HUP. It no longer complains about duplicate virtual servers. * Fix %{string:...} expansion * Fix "server closed socket" loop in radmin * Set ownership of control socket when starting up * Always allow root to connect to control socket, even if "uid" is set. They're root. They can already do anything. * Save all attributes in Access-Accept when proxying inner-tunnel EAP-MSCHAPv2 * Fixes for DHCP relaying. * Check certificate validity when using OCSP. * Updated Oracle "configure" script * Fixed typos in dictionary.alvarion * WARNING on potential proxy loop. * Be more aggressive about clearing old requests from the internal queue * Don't open network sockets when using -C - freeradius-server-snprintf-overflow.patch merged in upstream- fixed interaction with eDirectory (bnc#720620)- update to 2.1.11 - see /usr/share/doc/packages/freeradius-server/ChangeLog for complete list of changes in this release - add freeradius-server-snprintf-overflow.patch - use spec-cleaner- Supress timestamps in binaries, breaks build-compare.- update to 2.1.10 - see /usr/share/doc/packages/freeradius-server/ChangeLog for complete list of changes in this release - drop freeradius-server-2.1.6-edir-64bit.patch (fixed upstream)- radiusd reload after logrotate [bnc#634445]- update to 2.1.9 (bnc#615699) - bugfix release, for list of changes please see /usr/share/doc/packages/freeradius-server/ChangeLog- add freeradius-server-initscript-pidfile.patch - handle /var/run on tmpfs- specfile cleanup- drop freeradius-server-2.1.6-ltdl.patch - not needed anymore - clean up specfile - remove bind-libs, zlib-devel from BuildRequires - not needed- update to 2.1.8 - for full list of changes, please see /usr/share/doc/packages/freeradius-server/ChangeLog - drop freeradius-server-no-default-case.patch: fixed upstream- update to 2.1.7 - for full list of changes, please see /usr/share/doc/packages/freeradius-server/ChangeLog- freeradius-server-no-default-case.patch (bnc#527742)- freeradius-server-sha1-default.patch (bnc#546042) - freeradius-server-fix-cert-bootstrap.patch (bnc#546041)- disable as-needed for this package as it fails to build with it- updated to 2.1.6 o Feature improvements * radclient exits with 0 on successful (accept / ack), and 1 otherwise (no response / reject) * Added support for %{sql:UPDATE ..}, and insert/delete Patch from Arran Cudbard-Bell * Added sample "do not respond" policy. See raddb/policy.conf and raddb/sites-available/do_not_respond * Cleanups to Suse spec file from Norbert Wegener * New VSAs for Juniper from Bjorn Mork * Include more RFC dictionaries in the default install * More documentation for the WiMAX module * Added "chase_referrals" and "rebind" configuration to rlm_ldap. This helps with Active Directory. See raddb/modules/ldap * Don't load pre/post-proxy if proxying is disabled. * Added %{md5:...}, which returns MD5 hash in hex. * Added configurable "retry_interval" and "poll_interval" for "detail" listeners. * Added "delete_mppe_keys" configuration option to rlm_wimax. Apparently some WiMAX clients misbehave when they see those keys. * Added experimental rlm_ruby from http://github.com/Antti/freeradius-server/tree/master * Add Tunnel attributes to ldap.attrmap * Enable virtual servers to be reloaded on HUP. For now, only the "authorize", "authenticate", etc. processing sections are reloaded. Clients and "listen" sections are NOT reloaded. * Updated "radwatch" script to be more robust. See scripts/radwatch * Added certificate compatibility notes in raddb/certs/README, for compatibility with different operating systems. (i.e. Windows) o Bug fixes * Minor changes to allow building without VQP. * Minor fixes from John Center * Fixed raddebug example * Don't crash when deleting attributes via unlang * Be friendlier to very fast clients * Updated the "detail" listener so that it only polls once, and not many times in a row, leaking memory each time... * Update comparison for Packet-Src-IP-Address (etc.) so that the operators other than '==' work. * Did autoconf magic to work around weird libtool bug * Make rlm_perl keep tags for tagged attributes in more situations * Update UID checking for radmin * Added "include_length" field for TTLS. It's needed for RFC compliance, but not (apparently) for interoperability. - FreeRADIUS 2.1.5 * Release number skipped due to procedural issues. - FreeRADIUS 2.1.4 o Feature improvements * Permit multiple "-e" in radmin. * Add support for originating CoA-Request and Disconnect-Request. See raddb/sites-available/originate-coa. * Added "lifetime" and "max_queries" to raddb/sql.conf. This helps address the problem of hung SQL sockets. * Allow packets to be injected via radmin. See "inject help" in radmin. * Answer VMPS reconfirmation request. Patch from Hermann Lauer. * Sample logrotate script in scripts/logrotate.freeradius * Add configurable poll interval for "detail" listeners * New "raddebug" command. This prints debugging information from a running server. See "man raddebug. * Add "require_message_authenticator" configuration to home_server configuration. This makes the server add Message-Authenticator to all outgoing Access-Request packets. * Added smsotp module, as contributed by Siemens. * Enabled the administration socket in the default install. See raddb/sites-available/control-socket, and "man radmin" * Handle duplicate clients, such as with replicated or load-balanced SQL servers and "readclients = yes" o Bug fixes * Clean up control sockets when they are closed, so that we don't leak memory. * Define SUN_LEN for systems that don't have it. * Correct some boundary conditions in the conditional checker ("if") in "unlang". Bug noted by Arran Cudbard-Bell. * Work around minor building issues in gmake. This should only have affected developers. * Change how we manage unprivileged user/group, so that we do not create control sockets owned by root. * Fixed more minor issues found by Coverity. * Allow raddb/certs/bootstrap to run when there is no "make" command installed. * In radiusd.conf, run_dir depends on the name of the program, and isn't hard-coded to "..../radiusd" * Check for EOF in more places in the "detail" file reader. * Added Freeswitch dictionary. * Chop ethernet frames in VMPS, rather than droppping packets. * Fix EAP-TLS bug. Patch from Arnaud Ebalard * Don't lose string for regex-compares in the "users" file. * Expose more functions in rlm_sql to rlm_sqlippool, which helps on systems where RTLD_GLOBAL is off. * Fix typos in MySQL schemas for ippools. * Remove macro that was causing build issues on some platforms. * Fixed issues with dead home servers. Bug noted by Chris Moules. * Fixed "access after free" with some dynamic clients.- do not ship static modules/bin/sh/bin/sh/bin/sh/bin/shfreeradiuslamb66 1557252368  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~      !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~3.0.15-9.13.0.153.0.15-9.13.0.15-9.13.0.15     !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!"##$$$$$$$$$$$$$$$$$$$$$$%%%%%%%%&'(((radiusdradiusdraddbREADME.rstcertsMakefileREADMEbootstrapca.cnfclient.cnfpasswords.mkserver.cnfxpextensionsclients.confdictionaryexperimental.confhintshuntgroupsmods-availableREADME.rstabfab_psk_sqlalwaysattr_filtercachecache_eapchapcouchbasecountercuidatedetaildetail.example.comdetail.logdhcpdhcp_sqlippooldigestdynamic_clientseapechoetc_groupexecexpirationexprfilesidninner-eapippoollineloglogintimemac2ipmac2vlanmoonshot-targeted-idsmschapntlm_authopendirectoryotppampappasswdpreprocesspythonradutmprealmredisrediswhoreplicatesmbpasswdsmsotpsohsometimessqlsqlcountersqlippoolsradutmpunboundunixunpackutf8wimaxyubikeymods-configREADME.rstattr_filteraccess_challengeaccess_rejectaccounting_responsepost-proxypre-proxyfilesaccountingauthorizepre-proxypreprocesshintshuntgroupspythonradiusd.pysqlcountercuiippoolippool-dhcpmysqlschema.sqlschema.sqlmainmoonshot-targeted-idsmysqlqueries.confschema.sqlpostgresqlqueries.confschema.sqlsqlitequeries.confschema.sqlunbounddefault.confmods-enabledalwaysattr_filtercache_eapchapdatedetaildetail.logdhcpdigestdynamic_clientseapechoexecexpirationexprfileslineloglogintimemschapntlm_authpappasswdpreprocessradutmprealmreplicatesohsradutmpunixunpackutf8panic.gdbpolicy.dabfab-traccountingcanonicalizationcontrolcuidebugdhcpeapfiltermoonshot-targeted-idsoperator-nameproxy.confradiusd.confsites-availableREADMEabfab-tlsabfab-tr-idpbuffered-sqlchallengechannel_bindingscheck-eap-tlscoacontrol-socketcopy-acct-to-home-serverdecoupled-accountingdefaultdhcpdhcp.relaydynamic-clientsexampleinner-tunneloriginate-coaproxy-inner-tunnelrobust-proxy-accountingsohstatustlsvirtual.example.comvmpssites-enableddefaultinner-tunneltemplates.conftrigger.confusersradiusdradiusd.serviceradiusd.conffreeradiusproto_dhcp.soproto_vmps.sorlm_always.sorlm_attr_filter.sorlm_cache.sorlm_cache_memcached.sorlm_cache_rbtree.sorlm_chap.sorlm_counter.sorlm_cram.sorlm_date.sorlm_detail.sorlm_dhcp.sorlm_digest.sorlm_dynamic_clients.sorlm_eap.sorlm_eap_fast.sorlm_eap_gtc.sorlm_eap_leap.sorlm_eap_md5.sorlm_eap_mschapv2.sorlm_eap_peap.sorlm_eap_pwd.sorlm_eap_sim.sorlm_eap_tls.sorlm_eap_ttls.sorlm_exec.sorlm_expiration.sorlm_expr.sorlm_files.sorlm_ippool.sorlm_linelog.sorlm_logintime.sorlm_mschap.sorlm_otp.sorlm_pam.sorlm_pap.sorlm_passwd.sorlm_preprocess.sorlm_radutmp.sorlm_realm.sorlm_replicate.sorlm_soh.sorlm_sometimes.sorlm_sql.sorlm_sql_freetds.sorlm_sql_null.sorlm_sql_unixodbc.sorlm_sqlcounter.sorlm_sqlippool.sorlm_test.sorlm_unix.sorlm_unpack.sorlm_utf8.sorlm_wimax.sorlm_yubikey.socheckradraddebugradiusdradminradrelayrcradiusdfreeradius-serverCREDITSChangeLogfreeradiusdictionarydictionary.3comdictionary.3gppdictionary.3gpp2dictionary.accdictionary.acmedictionary.actelisdictionary.adtrandictionary.aerohivedictionary.airespacedictionary.alcateldictionary.alcatel-lucent.aaadictionary.alcatel.esamdictionary.alcatel.srdictionary.alteondictionary.altigadictionary.alvariondictionary.alvarion.wimax.v2_2dictionary.apcdictionary.aptilodictionary.aptisdictionary.arbordictionary.aristadictionary.arubadictionary.ascenddictionary.ascend.illegaldictionary.asndictionary.audiocodesdictionary.avayadictionary.azairedictionary.baydictionary.bintecdictionary.bluecoatdictionary.boingodictionary.bristoldictionary.broadsoftdictionary.brocadedictionary.bskybdictionary.btdictionary.cablelabsdictionary.cabletrondictionary.camiantdictionary.checkpointdictionary.chillispotdictionary.ciscodictionary.cisco.asadictionary.cisco.bbsmdictionary.cisco.vpn3000dictionary.cisco.vpn5000dictionary.citrixdictionary.clavisterdictionary.cnergeedictionary.colubrisdictionary.columbia_universitydictionary.compatdictionary.compatibledictionary.cosinedictionary.dantedictionary.dellemcdictionary.dhcpdictionary.digiumdictionary.dlinkdictionary.dragonwavedictionary.efficientipdictionary.eltexdictionary.epygidictionary.equallogicdictionary.ericssondictionary.ericsson.abdictionary.ericsson.packet.core.networksdictionary.erxdictionary.extremedictionary.f5dictionary.fdxtendeddictionary.fortinetdictionary.foundrydictionary.freedhcpdictionary.freeradiusdictionary.freeradius.internaldictionary.freeswitchdictionary.gandalfdictionary.garderosdictionary.gemtekdictionary.h3cdictionary.hillstonedictionary.hpdictionary.huaweidictionary.ianadictionary.ieadictionary.infobloxdictionary.infonetdictionary.ipunpluggeddictionary.issannidictionary.itkdictionary.juniperdictionary.karlnetdictionary.kinetodictionary.lancomdictionary.lantronixdictionary.livingstondictionary.localwebdictionary.lucentdictionary.manzaradictionary.meinbergdictionary.merakidictionary.meritdictionary.merudictionary.microsemidictionary.microsoftdictionary.mikrotikdictionary.motoroladictionary.motorola.illegaldictionary.motorola.wimaxdictionary.navinidictionary.netscreendictionary.networkphysicsdictionary.nexansdictionary.nokiadictionary.nokia.conflictdictionary.nomadixdictionary.norteldictionary.ntuadictionary.openserdictionary.packeteerdictionary.paloaltodictionary.pattondictionary.perledictionary.propeldictionary.prosoftdictionary.proximdictionary.purewavedictionary.quiconnectdictionary.quintumdictionary.redcreekdictionary.rfc2865dictionary.rfc2866dictionary.rfc2867dictionary.rfc2868dictionary.rfc2869dictionary.rfc3162dictionary.rfc3576dictionary.rfc3580dictionary.rfc4072dictionary.rfc4372dictionary.rfc4603dictionary.rfc4675dictionary.rfc4679dictionary.rfc4818dictionary.rfc4849dictionary.rfc5090dictionary.rfc5176dictionary.rfc5447dictionary.rfc5580dictionary.rfc5607dictionary.rfc5904dictionary.rfc6519dictionary.rfc6572dictionary.rfc6677dictionary.rfc6911dictionary.rfc6929dictionary.rfc6930dictionary.rfc7055dictionary.rfc7155dictionary.rfc7268dictionary.rfc7499dictionary.rfc7930dictionary.riverbeddictionary.riverstonedictionary.roaringpenguindictionary.ruckusdictionary.ruggedcomdictionary.sangomadictionary.sgdictionary.shastadictionary.shivadictionary.siemensdictionary.slipstreamdictionary.sofawaredictionary.sonicwalldictionary.springtidedictionary.starentdictionary.starent.vsa1dictionary.surfnetdictionary.symboldictionary.t_systems_novadictionary.telebitdictionary.telkomdictionary.terenadictionary.trapezedictionary.travelpingdictionary.troposdictionary.ukernadictionary.unixdictionary.usrdictionary.usr.illegaldictionary.utstarcomdictionary.valemountdictionary.versanetdictionary.vqpdictionary.walabidictionary.waveriderdictionary.wichorusdictionary.wifialliancedictionary.wimaxdictionary.wimax.alvariondictionary.wimax.wichorusdictionary.wisprdictionary.xediadictionary.xylandictionary.yubicodictionary.zeusdictionary.ztedictionary.zyxelfreeradius-serverCOPYRIGHTLICENSEcheckrad.5.gzclients.conf.5.gzdictionary.5.gzradiusd.conf.5.gzradrelay.conf.5.gzrlm_always.5.gzrlm_attr_filter.5.gzrlm_chap.5.gzrlm_counter.5.gzrlm_detail.5.gzrlm_digest.5.gzrlm_expr.5.gzrlm_files.5.gzrlm_idn.5.gzrlm_mschap.5.gzrlm_pap.5.gzrlm_passwd.5.gzrlm_realm.5.gzrlm_sql.5.gzrlm_unix.5.gzunlang.5.gzusers.5.gzradcrypt.8.gzraddebug.8.gzradiusd.8.gzradmin.8.gzradrelay.8.gzradsniff.8.gzradsqlrelay.8.gzrlm_ippool_tool.8.gzradiusdradiusradacctradius.logradutmp/etc/logrotate.d//etc/pam.d//etc//etc/raddb//etc/raddb/certs//etc/raddb/mods-available//etc/raddb/mods-config//etc/raddb/mods-config/attr_filter//etc/raddb/mods-config/files//etc/raddb/mods-config/preprocess//etc/raddb/mods-config/python//etc/raddb/mods-config/sql//etc/raddb/mods-config/sql/ippool-dhcp//etc/raddb/mods-config/sql/ippool-dhcp/mysql//etc/raddb/mods-config/sql/ippool-dhcp/sqlite//etc/raddb/mods-config/sql/moonshot-targeted-ids//etc/raddb/mods-config/sql/moonshot-targeted-ids/mysql//etc/raddb/mods-config/sql/moonshot-targeted-ids/postgresql//etc/raddb/mods-config/sql/moonshot-targeted-ids/sqlite//etc/raddb/mods-config/unbound//etc/raddb/mods-enabled//etc/raddb/policy.d//etc/raddb/sites-available//etc/raddb/sites-enabled//run//usr/lib/systemd/system//usr/lib/tmpfiles.d//usr/lib64//usr/lib64/freeradius//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/freeradius-server//usr/share//usr/share/freeradius//usr/share/licenses//usr/share/licenses/freeradius-server//usr/share/man/man5//usr/share/man/man8//var/lib//var/log//var/log/radius/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:10185/openSUSE_Leap_42.3_Update/347b0d66da01261c526d9a128e995eea-freeradius-server.openSUSE_Leap_42.3_Updatedrpmlzma5x86_64-suse-linux  !"#$%&'()*+,-./0123456789:;<=>?@ABACCCCCCCCCCCCCDCCCCCCCCCCCCCCCCEEASCII textdirectorymakefile script, ASCII textPOSIX shell script, ASCII text executableUTF-8 Unicode textPython script, ASCII text executableC++ source, ASCII textELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=2130780b5a44e06e005d327f2b1232db65e40461, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=8996f2e79fc607806035388f965b9dbaa9cd05f2, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5c92424085ea7dd9e0e23e0b783a068a3b61c266, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=830365b8e685ea770d6ce9607256d4368bcd8a47, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5c0afd460df1697ec0ad3a383c78aa7b967a2900, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=44feb2f34353fe376110e3a45ac01d8c3d00ec79, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=357b74f1ec564798533a0723ea3a542f831d956f, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=6c3eceebefe11f183e70c939b530234f4b3ffa2a, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a06cb799f7d35565e98f9d87f3c0c5fde38c231c, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e625c8b213ef9d15602bb064701dc198a2a94bdf, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e3bbb45d8f0fa070153d3f83d9e56408425c8bd8, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=45a08d5f0959b2b660c81001c6b17f15de674fb4, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=2439efd52f9fef8633fb2f7e2173eef71b430767, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ae20704cd76383dc674518ab6d9cd64b4d4c6569, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=71454bae5121123d317082b1ebf3192e5a46a2e2, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=741bc3388864c35e62f0a472586d67dfa2618a70, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=386a34bcae42543a34f46d60647a4c4c9099003b, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=5d66082952cd6ab673ba821331459ec005a382c7, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=c1fa9f08d4ad677d5b0d6e442004dd93114919af, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=668c2ca40c69e2f55eabf1a2623b221fb13dde23, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=900e3dec8758f84926150c9e3557d2d0125b7d27, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=313f6e61d114a52efea49f40b2c9c247cf6ba25d, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=e3968a566bb5661fc23a340ffed6b5d2973d120c, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a31b2f8d9961c42c571ce7d2b81727225bbeb91e, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=13d61190dce1d7d39ca2b9bf99dc60955aec7f7b, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9aa8b47b6c292240081cbefc0a8ba4d331a4438a, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=70ac382bbf2d3cac60e8fbf82c029acb3dcd20e6, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=eae3f94cf8bc80ed7772ad4bb76e65a4a41352a3, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=3c2f2762cb0813d035788ebaaf507865196abe07, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=144f949b621ae6d0c2be9939b2fccf200ee6f9ec, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f3dc384cfffc434f33092f95b0bf7dc3796543b1, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=b1d6d8feaf0f97613fa3351c22dcfae9b8c6a9d3, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=646706b416b6efe88bbf58a5e31624498bf29340, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=9ad6074457043b3f35c1fbffad62a10d88a4d992, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=494c9576371d2bbba69bea19ec96294c84e3e9b6, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=76f6f402c4a3dce056c1d9462af74722d5c92532, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=577184b6bb71162ff791366cf4e8877acf671482, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=34dfc0691a007995faf2cf20859e745df4ca9dbe, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=34d4a13993ea26941d4c07d7e006c03537d78217, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=fb11594f4c9be2620bd8de6e07531971c4c7dae0, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=d7e2108eb1a30d8f6c37c112ca57e76330a0433c, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=ec855890f2d62e2ee452ecb111f8be86293f0f69, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=1103672acf0ce3f36ff91b661199aea2a1133582, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=2376a8caa737cc4216e8e7e9e21c3e1a5a3128cf, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=493bd6382a02d5a1173e033a7bb2a1eb90a40799, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=a1f8b26120919d68a144cbe25d7a634b9b257011, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=24cca24366b487d067de7a0ce842e2860430132a, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=68fa866f4df90c0979c1e0c944d436cc50c7fd9c, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=feea5b6229675cdfc0eea1832d485c2549da703a, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=fa46b6f4cf60555829058284ba724dd10633de69, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=92bf7228e44068e68008badc2c88b4ae45941d7b, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=bd7d0faef8ace9a7bba78532a2fe44be70aaecb3, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f91f1c243b3e6ca9814dc2ed4a927280c36992c6, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=01848a7a83bbc5a94a953bfe4b987feecf82fcc1, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=f09a1baa5c20edd5c6c0bc8467a42c07dacf282e, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=82653afd5056d1cb36bee101dc2b7e8f8f555c57, strippedPerl script, ASCII text executableELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 3.0.0, BuildID[sha1]=fa614f33e9617fa1d4bb455e9468e9589dd7d6f3, strippedELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/l, for GNU/Linux 3.0.0, BuildID[sha1]=7b0399a6207140566fe2708e24408d269ead4151, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)troff or preprocessor input, UTF-8 Unicode text (gzip compressed data, max compression, from Unix)empty !(,38<AHNSZafkqv} !(,-.@J   RRPR RR PR RR R PR R PR RR P RR#R RR"RRR P RR RRR P R#R R R"RR P R RR P RR RR RR PRRR R PR RR PRRR R PR RR RRR PR RRR R PRRR R PR R RR RR PR RRR RR PR R RR PR R RR PR R RRR PR RR R PR RR RRR PR RR RR PRR RR RR PR RR PR RRR RR PRR R P R RR P!R RR RR R P"R RR P#RRR RR P$RR RR P%R RRR R P&R RR RR R P'R#R RRR R RR"RR P(RR RR P)RRR R P*R RR R P+RR R P,RR R P-RR R P.R R P/R RR P0R R P1R RR RR P2R RRRR P3R R P4RR RR P5R RR RR P6RR RR R P7R R P8RR RR P9R R RR R P:R R P;R R RRRR PC9%7, ~ zaW!-Tz;Vn=m{q]ATz惄'U׀MH0 dV\V+ 3tDT9fBGU;ymhR 4[Eo JpOْ|`n7`I?Q4m˞ш`&EjhaU=]67/¢[ >{dc[do:08`tI>wO(OtZl55I@8=83Iu}]ޒT}O$u$qeY<'{8FC1{4FFyR"82A( 3G>{I孿 ϒS5݂U ZBT2?{,+C.xV6ܪ),(b.i43 'ZHl7 儖pH*}2,kN%z,@v5~snAC/St`M1ٌ`NI8`22|7{vc'0vCP6T]a;Jj W4=R^ I#ݍΩAk3Jxl\B#XG.l#mc~)mF=sJ?UO‹a899ug>yK}ԏfqǀt]=¯.UroϟVLgL2-9JWmvp[砡/ "$0O1?!A* ]x:u|W^w>?TkiAR]cdJKؒ"7P؛#۴q2e3~iIu1.ZRV:fb)?5.ުFEL]T ڜO'Kwho^H%d>)GFF>Τ:I8 n&ND^șN9ePFT̗ @N?52Z=bgVN zsw{iQԣ%EphF@@t!cyڅ#UiU\(L,Й$ys8ݦF >_Nj]ESs\NymYmObLʍ3'HҪGR+Wr}f2ƛ]oc7JN qAZXԁ\6\L0PRIsgaw犉Cw: ;D_ oߑoէ9MT49OT "װaŞAV[s6(kdb7s]/ӼZ쇚fHmwI{kL;z+ ߉zL sbPrJ/s2A g2][I'9ϟYQ0 c"ѵT? :wF#e!U-rBӴq3ZN6Kj̫i>GH2&ʔrb}YXNٲElZ?͙G&Sw2,DUj2-MAI+d\#msKu!6ylu]vAX}Rqmq]M36{o݌SpotsǭPd "њvJ]?J|Uwyʿ9$v(syF::~ l%o*C([n(l{k=I$K޺V47= f'+X-1b=c٭ igdth!2ύIt;SEHIȘlr;F\Òȑ[hƣi9M,/0LyQ~b%C؀Xbcuq#v$6sޒz8oqĐ8b/ffnH}h[Ʈ-jyȤ?nBp>lA/dqHE=ʋi'`MmmG1Yͳ.cM**8::*nnPH,{ِ φcm29X|S^݂T9>O S(vp8 ?c [Y5do 4&tgÉK2޻ 6㽍W1cf`1o,))kذ\{ZF.Glci$h`Y57ɩpC{ѓES타[Mۓ1:~BµNqY$}XQ[Fn5%%+-b3ٹ@ [MPQ΂fnu4r`Ng~,8曠edE+jhi#j!Cs_ hNLɜCANKFuz3/UiubɲbgL|R_x86qz~#R)E^o5\]Z2j3~*3wF[7$fl7&_E\ i7|}Tghڞ ' 靣[Ro?709W~I5PQ" =FB^G7Xbi"X:Ov +G*3I,(oyߘBD~IfyOR0.Oc2(qPpg*f}Ƅ4-YJX@vG=I4YL3b}>R72 %!gB>wR*kI0I{;1CU`=z i\ΛKkzZ|8ʵ3KsWe/Zse:7RYӰwR얥+(*2E:  ;+=Ed m6|(l䨑0䃢k 1ihOIW͠*rPeu@n;h H)0c r bۛh/$8 эR7zu)R|c̒$0tTB>˿ڠtΎuNv.8uȅ5{n_4uaә~'z4 ]2~ AmO?sʳֆ9,/IF$؃x~~I ӑ 4T$aBEC5ƻ F[+I=?OuO_ Ǧ y/9'6+4d QU . iL6C 5R_/^Wh? :K8nw!'o!#f__b|(-be:"?;dqJrJUpU]@ŏM`#j)>x@Z.g*̣Kirߘ_v+jE4(y/+GW,$&MGJ|b+^.L#Mύ#'F2$m."Xۯw$2GH#q}fX/Уt‚].F@Wm@J!I37P{uOVǀ3P+J ?GTxWS}HQcS\xf_ E0U¯7|Ŀ],ԩT2mwe+QIm3rgSmۃY+-WOظOP.m8R%ts0H!G8NG -8d`J!Mlj6!SzRoyۤЮSxA#!b UֈXX/ɧҁn2xc*Ay8cBq,qbX?)4AnQl-1 6;MuZ!{qdP@1K'Xߒ/"|Top)A5fLcaacp="^;.1dtR22k='N:YAw==e}Dp;X7]DM%so3 *'"kJK?3ZJA;q6Q\ǎ=Vcfj=w[ӫkDL!%@]~v3}(hdUt8(MEGbRhmwHcH}G1ٔKC65c\vs@V>}\rm0]?ʔ\%}d3>a?yʉΎ%NZO<~#{i7h,X/!ayZihb#MscA[5)KC)aʍ&\h}&s,&'[2.q*0l'"iw/u4Ѝ༻ 25%>F̮&'|I!&eZm o嫜@Gy$8ˡyHϿ=S1ꭃhsg}9ӴC1k.!Tm%Ti:&x|i4i#oPhaktC.p5 ؐ>. 2'Ry9 fKBX/FGVJ΁ aGB|\n0me ^QM sNEժcH'!;waӘFKd<*-\\8\fBԹ|è/O;bǥ <ʱZi2 ߫B oX3gYφ v!iLI@* hh ]%ta]ר'Wi RDY+1Dj^<N "(Q TQql9$(]Y43~Ý\dPn!N, ޳Sʈ qd-Y8_hbUkv gD3G@xۗ(lwrԳ2!VQ5UVm)ko;{{0χpjSJ*3-#iWl_qΕlzNajXيҍ)@Nyq :/v/ Gh (DT#譛=.4}/RsGҝ9c& "v jzpɫ6; (mZaRDRuFe4m @D7mT8RYOoJܖuMv@X(Q!T^_ ^(sń(I1@ 1cpAE Xu5L!bwE^q_} =UnZi_&_>xRR.^cj8W%(CO:߅f> \Ng'ڼ e,8WꙗKBR'CNmL}X~dBz>) 8 J|[F̛!C\>W)]*vxX {qv#~?2ծب/۷r)ĕ#NC?1q˭ Ž0|Ncethng|O\hfej72!LG~LYn{ȃ:%U`Sjx6lB$(΋}Q zpAo-6VԖ4}Ξpn4',X@Uլ N:!+-5R]HPPV̴@A:ь/4r眎*H"V -2gmd^z{2%6[Ou?$Mp}h} Z^i]ԟ'D 邇i}+ eZ1 YU'qCI ws*Xlj.Smu{fBRzDZ>ZKfS.P &v-}~FqN=dN*𰄂+\cd $ޝaݺs 4:|9]Koy9IOb& [2H: b\VwBpmh\M +9B6.4g8xiZg?ws:86F"&*"1X+P$Hn}Ƣxt(e|&9ТoK30gpb5QwMswx[[Ɓ 46M:7,7*5i>JVXI8TDz𬊔fn @<{TS.[PdnʦujbH>HYFFu!nyZ~r[f8Ly>!W1 [\QNvRLA);X;ϩ$<͂]e<#ݶk{&$F=gƯ ֝~Ajq$5R /Uh|V`XB2ߛ 8c/JfmÊ hf%m~o͸DEڄGO 1'Eī)5x8=O*8 WS~EpTO>3aILDӰ~Uz"@lLNB)  | )?ARI!'-a8Jb++~-*+$dibܞ +D('S$$rh.?r gXRjjc >OMTt"؆{ @ƏIKπ ns5ꡧ_Q4wŻ;ҏAyHCZ>FNpW^gu/.1!a3󠴥RV.P%{72 fN=`c-A*f78rU PEׁ\ #"~5f[~?_O25F9|X+C 7LpF +"lFkKRHh8}V®S1_FhW)o]ڌFgxMͩ?&vj-`dRKH(6/p2o[@Zl]˘0w/Wp~%9SД{:s+*(|lIɻҾVC'3~ng:mdD[rwAW|La?nΗW.I:ohn n%}[s]"i7vQn~p1MD.rY393 &2XF G@Sͮ}6%qRZ6P7U!nEX\LF=FX"Af ~!$+EH_DkãenI%yZ2FfB;,{H wjqCQ+rf# ~cs%w;ù 8zO 镖9!}}1]| /G$H_oюiQP3*p4\|ɞ;0<g.>JK$LjVڪί=M p~}1Qk5H _}퀷jџ[ŏcNSCud@/V}nPL7"a罡R#yO*^oN\hi}x:Tˇl{&lB L\v"W Qt-F$]5ڷ{5wYv3E\Fm f.f&w;8 ]q0EvDL|58i\JWKxT|4ƚ]^X@Hw<$"Ga,YUc(ߘĞ":BAAac|HA/ۗZJګb?u\Rou@2U;hy-31 YDQHos=q-mi SnӛidOʪۈ42OO"Mvl $[ u!o?땞Df/H˒p6nk6 Wjj;Fŷ#N|,Vrˉ##8/_-|~ 96&s~EFXMcŽ%ĹX,RU-Qڹk2LC4m$1ШЫlTm_(Z4 6iJ9 0hp, 5t*4E_tq2[B$]VXĘvf @=Lޕ@BQ< qfpC=v6gP)PWU-m5+zc{ai,ĂsH9;ڼ&`xhEb 3GljNUe}* .\aYCI"|J΁& ِ5-aë6'˭si{/u^ 8S4gIhfn!>'s%AD܋Zt:Ktߍ_9UK T%V|Gn+50HbLtKBQ?PqK뭊DŭlΓ P?gϬm}DV|# KO IkxH(t= .o݊i} ViAb0w/kxb7!<-4a\MywXDQ['YWބŧ\!RkU`5-VΜZ9tCՊGEM1{+dn 'i`pxb_ iEWo+¿nJPWfRÅ.cV 9RB9zcO=˖YROT$KϵI>TK_RՎVK:1tEQ٠_OizbFP ' %Bt'E VPI|\9S`z)hq -& F_#zl(VO@j7)ָ 8uI`7b򋌴sXZ_- & j:l.gc"/ވo{3/ӕ%/Gi9%Yi;r}xn2ƷZ)/|{bUT"l/E]B< WvN~FT:GFP\m(Gc.=ꎥR[]\| '؝V&h!aPp<66 1,C>KUq. c]CKuѭu ,7 ω0k rk ByT#MY!7P4cspQ^i_~ԛB(oQ5P:Ei-B8n +AdtAJ~\"E6LúidKYH"[@X`A[_nR6C0K )]R;\CF_R[+K܍5tD|+ӻ=D\h?7Bl݃ҎQ*ށCÊOrq';0vӟ>fsޞGGgFwcGn4WwN'+N3!'t k4 ]Y))N5,_NFȉ:,bphzu93R>&N2ǣT_AO6_.aӄ8.,[j3dŭVQÀ U^qi Pp.; "VY(]ЂYw4qb4*82ڰ)"swoCw $QB m!Z,)=]|"+^)roĉol92hHo.IHd1RzKrGeOΗeЯ9a(>Lw4T1<= 3ᙼ y45Lg>,Ӊ͐xl.5dGB%K1B8<^P K֘p"rz ޣ`"CI{QoSY8g`L@A\`lM텉F-7 5NZgדerSa6i^N8|sw+(92\TtAֻbJ-.^X6&_ qHcm|t܋);MduPzGX+Ihs\)ef*[4onzvm Ul5I2(zOưt3t˞ rlIB:64/>ֈDƶ ņIfKA}X7zn GJu+g*jCƋT?:aI%g80.'%VBn( |j)%8WJW;ZAά 3+yS-sP:8щ]GcQ~@Rny+1Ͳ Y2#fa̘Zs*}6P=#Tj? ~vWxH0l턏PK";9R8JGdXKR ,71&"IOj̖=!FMp)!ٿ?Gh ):<$X,]8Ix+̓B@,7,$ϣtPM׌e+'gQG:gd3Xͬк5h-}ja~1[RAt5#O@ibWHOolhW` tyC~I"}@ W[ cD*E) IEm~S(~VԦ31A:)$SSsXZzL3fy,`PxoVp7}11d֜(Fo'H/xyQSUup@1( Q.NS<)S:`*8APYd~|nu -T}G _T#$݂,γb-o\EBܟ€b׷Dgql&Rӿf~-"^7Y,6ȕo|e뾚-:\LBIj@ZDNzSH`Ahtd&;x7oYM4-՝/ "Ϩ5-% -y@]]WX _fu\9J!y%GMeEk$uߵSSz?aj= 2/fcSc(^yeTS`@$VQ9k:"|?^|O˭Úy_M_)W82٫Qe:ޤ!&*:,&ОMPDxy *G71 g\i|+Zx ajΥ,ȉWٟ:]]Y'גُ uL0WK @Z:R>M=t&x3τ߷]d0yI{7pǽ6qd g7I]W7Uq`:. @mVA$~aD-P 1 NԨOَʿvH5c)Y#!.^i- ^;bwvam`=d, XN"4e Y4J?平p 1Y0l{cF?6%l`ھ;XmU zpXBt7p LL%-BQLoʍ \6YxSvv%Z|yP鸾f7<֧hGɸ _My^- Ó[Pnb̈́s8\˔  x*N4ZǘlX`:Ku$2fh5hZ/ և%s" ŗƮq͒O-8ާ(WcVAr~#z)3Hd"%`zjh&5 zgQ?ڂ47/ KfX6rnr{Nt:-DBO n/WLG֖m`cmsխ3[=φ"eb8ĸ5ܖ-^<y>%g*`68  𑥫'5 xX9ϖBB2)k pHWѯ":ee ߐ_h=65D Ȇ5e 6Hj7Q.G`|\d~,2 ,pY0Z"gQ P(^fX=1٣ˌEeb|# _mr8#S>V\?a\}Wc0K~ ,ބ4GG$QJE1qJ sB|<{ZoPb_ BJ!|Kj& .ǿ/*V+rCfw.؏uVLȴ <2#j"h7?M2L|..Q7 %>yti?IAl_uq=ar7ҪWp"co~NQܵpYb-l z|w`ϴaK/jldQ0Ce"QERTW]&Ҏ ѕm3jB[ ܹ2%HK{kVoUI$AC$lq ÿQe)dACpe)o5h]RI}7 LO=۪-#>69y'+1['¬`OD̆%abqK)-'⵹^ 1fֻkJ+ooJmj(Ddk+mӉ|(VR K &צ 7GfRX{%X^(fE/Z,4eqW2 c-̻bMf償יoc&} R+~>ĩp6.m2I0nO^ ֝oTJb|g+ACs}3 z4!qM>(ږHJ/$I1lOF'",myX_Q$VZXoa|'Du t\4 Ei=v9 qz8|ݴ+[XX>?;ڎ7N]{ȍC7z7ACb~zk<`F/jflfOռ/b罉ޖgpIi#sqy#x[Th$iaetcjddY3M'p+HXL >NzCP}:xCj,9BLӣŨ B4qٸmۈ*9ɹt7h5sX:yDW=6|TEAyn '+3D!9dfGdq1: mI -\-;A0i?f\־ r81<%x)֌Ԭ3Auiؽg,V+7R!j͒ȺM*SUr"YE5h=3t aynqϽ'^"=  ZґB]WGѽ$^$rE;#\bnӣJ!@wvG [ⱞf#r[LIP!exQnoYd(BĞh;_nuEAF$uڈ\&ۍqh8!@?ղJ=H^n-6g J$86frgD܇?F;C'ž`B7P8ܒ"Kncgaʢֶ.znr zq9֋ڍuAQC_Q.T-ܓf/@y3Mˤo|wb$xS+K(1{г;"n^}$i3JcYFYRE~VYyVӝ7`:b9￢ C4}.7noS`6{QtTo=Û <ʮ㗍Qχw@p<3:ժ3ԐoiK^0ׁ lã"Ehf&WTov& X4 μejy}TwjAwE%!,s`ݩW6@dE®>L(Xsz 3gw\jtsf `7俿rh.h%\-aBgjkg4NNN] 6K1m٨E uJO> 225˴r,ɉ֮1p5N=4rg^ӌ赼z+"M:]n.xA Qt-!䅠ƅ؍`>y)ou^&XWA ,4q>L8;)\(l;fdR ; k'Lt'p ZxΨB/H%b^ZƎ"1DYLE^=js rFf˞ 3}.]7*n?f] a \YgȂudŠFbbH&*IAEy_zvgFC ~l! Pl9;O33̢0z48RY3:dύY\bb>Q*>6օA Ӏ5#WضM5 G t.f VSDilB=0V $Xby,b?ڠ6{Mw 4 LEU6+bziʦ /hVzzBH|5q)ďKfRJst(5[~-'KWXb/ѫ"/A%q^ʲ&60EGQqwQ (uP)ڒHSZ!|QS `ng1q"%9-ZO13uYNn!uY> 7AO adov:|9v|y|a6{TIu& X8E\ B,_// wdɋ$0.[*ΤoC}OP UeMV!/6}f; 2P0h};Ry>d J̇&yF`1Gy8sWASN  µ-=a SZRDO$1&3 A_.'K/t&H 3𨞩$1?Y}Yy|xmr5#hLXReC2vdZ Wyʠ4p|?c`w;vOK#L2(}H򹈝BDkf1Vn=jʃbR-F fYQC$Sgha=sKućsKwၕhH{ Af7Q*Nָ^ .F^XtMi0'L1-~  'p))tqHv;!>[fXv۳H1Yu }g͋_ ha1R6UEW*`*MmzjȃSBhE0!iG A.HX`z YiA,[[\ʢ W9X-azs5*#3GGlUiZEi\CYFJU{g\R[H{'^';"d Rx;IԊ QwHEJPN'8l@LFV<̫rnJ0\kW(B2u:ރ=5 Ud.j|Kzb!00 Ȧͧ{+ݗ&܂,M&ȧUn5('d:sE/Z} a8oYx5F븍ċ)#4Ȗ&7ի90K %y/8lWSr!+PȘL)0EP|RV!ehkMcUG@7)RSbgYǗ_eu:Zρ4}/.y)OxEikC4T#Y%3ѴI^ ( VƇ/~%ˆ5_Q+B=|Ê@a+<!"mᓴ.'f]Qy/Cw)v-%vYN&;^FFQ"wK4eʗ&#i XBKw"L5sK)vE7@;JuQ'UZ'Bī}M2 9SsX*{ ˜x"奖ls~uv9lVLD;Ե`NxVQA!+]bXg`u}/2,GK¥%5S~fqŒ^5).=Ç+4@\gg<d }St:B!zg:+`(6m;o{}O\3/]4T#.ل|Lh ڢ6V_*ZѦ5N%$J;:e3&Eho>x%@{$N@}2!NǔPyߋ{ ۆ ~#`gC`>\zR: KTa}X> WR\D]QvQbe, 󟗺{x^KnI>a~nݨ˛4mX%"9Xpu|$A{xܮsq}&0cu jK'[qb׷QXwt0RX\La8fbCq%u 9GmNj1'RN]>RޔЧ/K$!N+y}5nq(/$-Öit߲qĕx zz1{#w`E9Oz =wJY >&ij|A-z댜U'eެ߄\@9-uO93Pͬ.wEZx49;x  꽙*fa=*[i^AU&4yJg֌qgZ͸c{BAf94^blPOSS"+nE޹ff+b$FBPD 9293*RP\˴>M_+IeOg:KZz/G=[<.)/shW ys7O_jDƨ K:@b7M5a!Y^$  ޤ_Cx_ 1zbo&A9M3YQ%"`:fChJY{FuF&5vioIHX4 27e9fDjsgi<l d1d{@ ʷ* řj`$t$A}oiZ jM \ɭ NZh1So\": d;fV|<,vh#%qIԵ84h+UA,C 77IP%@QSZ\]0DWYNӵyh"TOdB :S_'ȟc)}性V Sz+xd@{ 6,+bq=#K>.jnG/b,l[Vgxd|$ʼ$l U eJn̮0ՊqH.U#;f7fs7,$X|q"`F fv;̸8n$eQ X_5K@ ʈ0 NI0~5zBՠ#%y!dx ֚2 V5 l{y5=A Or>͂Il%2=kʕz^Eb%B˝3-gK^ /5ɖ#"UzD 8czn~~OU+`[j@:' Ey󍏐(jOwOH*z Ƥ{6gz{ىApj[GϮb=,fsB2׸Ҁ܄uJ.rDJM{hBɭl;*ZqDk ^~?-O&[qJeJg@e?w j\ic4QP5Y qg_0w'wiﮈI5> &c!e nfe9BSQ5mi!(!qV'_Y%\돿E:k{7| E*O]OAm-00t:ZAj`Vт=zCa9! uTGY$; 9˞T?,8`‰Bʸѿ0|5aʚiqFŨ3[v.wR4Pdan_>cRx9zLK/ҴGB5 v6m꾐2ZH\ᠦh!غBfЇ %7_isգa}4)uAȪDoy~+7<9Og uHoQ{],D="@(xExm0Zﮍj`'W>3k&i 4r$[Wsg˷+k[ }-(pi"֍ůMO 28,'@ݨIB[D=I]:|4/_`Z8vaݠzxg&ޏ6T6?lys{]./_z%Vi1|aOlIX/Z?wrljb+PGz9$S` F3ŀ;|%*ʒίۊ8:a,}svb!IJ`+DD|=n_irz0{Qm֡L⃪n}lpd+/< Bo7$1JCh?*v+l~g p[R#'IO כ7QoŐ7¹ma7 Q*&^MUuy E[2ۄF#c3V ѺS'?7h>ْf"OzA(0q8(Q\%Z)- EǶ'L]6}@'E,6m@O$]=/5My&KΨ*z pv$G;=́tI2Eaɼ'j!x2(W4><= Y1k6-V&`t-WmzW>H67ʴHi-8=t#q, ! P+bEp{AuQ֣ysO(doci߇Nl"ŹFqq>9fL.Ä1n NA.yA5iOU" jlаV.g;_)KN鿉#V|]p~X`*ς"A^^$!!1 Q+.ѦBF0:<ҹ7E` .ɞ/x\}\!%_#eCA!%ܴo=KV 8߬ZY")m ^(.0i§&*l7"]UķI`Hs#_= fE|P;׳C9U%]pn2AxnHeUdn5l͊EmP][)HY밷ᩄEMyHWzrc>'"99 vHT\T֢-u7ŕ{sA;0-*# o\{ʁҬm6  X$p~hN`@ė&fU5bǏmDse>@_A+_Af :k.曨憢o<ƥO Pm-"$bojn>hPbg;\i!d->9-J`S$ߦjt:djB^UUu3m.R:;7Ykb jTY&`C+Y'nFH7'ʵh>Г-;G* puDYiO%ݸUl }_\g8PͼUhg|~#6b_s9s9 Q m$*DBQV5 :Gc%AtZXx' d?ӊ2'#<e( XEB$  `-UNsSZiiY$Y?&B4͔k93=)B?ӼX \d`8(},bɥ ~f2xQ6"ҧݕt%^nJ)Ĭlra>b6{%r4luAjdX*>>萇IBDB^3Xv^Zp8 xȓFL$;kY{τG׉rU Kct i'q_,W61AzFGR3KטxW[0-ZtW\p6ĭqv}&6/Ɍ M?=芒4_aEHz虙(DfQ}2Z)d\OSuEo)t8hXB>'axf}`~/I?=C,սJ@\E̻̔ZRo):I;tP /w(/x,^(i;o^q e5Xu_]3U*>}V~,wa@鮹-95ݴ/ v'Y#|H!x~|41(;+^%Ne),\LtDu+GssAVwOo/*7Xfײ=ng75'#0k5%SP'0WJD1hpvЍ_n(14bRJ}%*sYR].b:^-b[iiXԺVoigt Ou*5go㳂ެ 8;2v/0hGAHe^EOОkVof \QU]EMڟR{syú0 I/}CV FZ0)+w{鶲1*-^]sCkp.3"&wGBK&$K#n1'Ƞs٭L*0靛MS̫.{6$;a~)mDL)^ٔ@bnR=@U jr.[~zٞCB  Qȑ_|Ykh9/81PUVAѽ=ıORdZUZvx=-~zim?@P5|D /ل5cL׻J7,0 *hzf9Gl;h]Wg>" ,+gn}^\Sq{j`毮΍ 'F:jx-KOcw]M|"h'jAе! O=B˺ԭ"pƄgEm}~kY;sp''ap3&' u 1Q-+Fߥ***Q7""~_xOoAt7x,CͧޫG;@eI_R1 ~'}|g(Yge[*|`+۟NqnSq&7=ŵZʨJk^V*^P87)H4޾;Q0;*q@_&XM')wGLD+.䩓BtgAwNW=,9( /!x_}"{K3:!JJfUq5d0m;x& oe,lnIN ]B^cNi0|7 ً?%wF(y(KXMBNCi)b[IyM"3T imNw7Зrexx4IO佭P=BQrKb/YiRUVM85<WL (c$e{gEm I1Iag|^Km$`}[&Dt4l?ty`Ue) X(o @РwpBjB F{pLϞ%T1 20=$jQ֪%/DW|8˥ᖀ$V[3e8'3JcC< 3xf2e0dEjd8<@@Z!~ORzsOUR:Y1&~kQ穛oзN1c^'gOv*˻Z~$<{px&8&;>e4l{nDeGGTD!ԟZc i!eGnKm>9"=QkߩeԾZ`.="F uMcϫ*-zs`'gzۛv-&% 4e<^I`58n6: {P*CODALa hc JU3md)/IigaƷ}˴9 lxJ7cȀ>@Nj֎- /3rH9ϩ`.ϬZ"H^A)R \ٕahxI= 6D| x4otf?W<נ;Ǯs餧bocr/[!)6P:U:(Is^DdKD5my#lJ|Л8Ly}*n{_}6!P7-0zUT4n>֒csAЫSPs턔2s6,?~}DA4.̻LOc/^yA{p%ՒN@E>xw\w 8i,1t' gj*_mN)ޱsǷ\i_q^/e&zHrFԞSL|^qQ{F-M=5*O\7?1Qt*f&SQ#Ȝ6fVU~7Wb;)u!*7Ѱ>'~&~ܯgTP'#Hj#h$e EUP9*l3'lsɭYg脅4M p #\ SANYR<3:"Gv?>YL4?`ؔ[d *-z~7©otU0xI&-?sUL>')\=ֱzZ$ z`*F6حe+ {/غ}F{GՃ LPfFQގ6Y0;-/rHh+ͷfؚb=FubE䐇lȱDyPMԨ\WHZ_ WX` S@\%:p$Ya/ttŕtwҾu Ƙ7۷iEhc(SƪWH` s} )piKڥƞٹ4rf+oúJ  TV5@~;ZX#"Rl3"UB]&McN,/A=Sd-)W/í ĉgj[7|[}*}}8W)ٗeȄS2+2uF "=)Z.DP~Z]η| P.wG< QvB"ׁ#pCwQc6G~7ha`p1Qaaa=FW{T;+AFXSl<*25*g%r,$j^b uf u9!Ef Nm ͹&%5 RP򤘴SH,Ujhd\tR N1OO;N_M)p00.u@/> M;$]nKwո~soiMfA{t;ͿQ rSƍ )H/TFTq(417N$mn kqK9[[-{yeVfpex=$ p-S7+q)dxx%PVۯPPLaN*YrՓoUt0@en5F"%#.-b֤0db/K9˸]#ð  HFZj6.qBƝJs?{>Ց 3ıMc-kg$XؾekXJs1xḂT15 ԂFgs<@$zPאcP #)ۨoǑ_nIæ&Vxlra1f l?'2xvuh|Q0;Υ韺02A-^C.o @CZ&#B_y%*V<{nKl N8Z4_%;*z̪݅_r BqpM7$Jإ(/+{)<ې]L-Z ǩ|NSxi}%`V e[(UUAS6ʖ璍H$鮇δ^jn9jB)"L*7ל$Lw(.LN5MLkt>VwA hv:㇏Zĸ2Ǫ-bc,훽vYo^̕ոȽ=pbPy]3Wy͟xi|i {҆[OҩiGĐ6IB؈9\uqniuL𤹘 ~қӠZ9lⱹCcrHp{i?tj'!|F=[`V0_-e?q.Y5W 5$ۨtӾ~El 挄n#y*M ۲C>)-a2Cn)«\?[ VWSnG b7CSz2]R/T8^à49EhJאx}J8⺒6jGFA^NؽJC#qJ^u;T؊t] ~("'hBzޤ Xc"nڷ eI-hqn7? 9>s9Yq RA h_[JcRUN%Ehoy ʟRM~p k5?BpO6g\+t ?|iw Ǣ+ 9ڴ7,"? UN0uS/̽#Xꤗ` A7 2FI ]FMؘFgëHU97B+1@Ƨt/|RȻugZO`Ӥ,~ p_8Bi:Mx쫐o.nEkyS6Ǫp1$DmP-CںGߣaZYvӖ糪  < f3,ʥu:SԌ ำ5~``0rxpa@QM(Rj>'SUCLZ`#>꜔=ӽ~ʋwNBF\ac@cP jtu}p8o mRŸ'^y8^jpD^ FCUEUqߦ8O?pz fI8])iO& N@TƯ *F\T\4r$j^d~ C)5S෠RL~2oli0`;_NDz.r.ᰋF"ۛ=y GCm[q-]kMH/8Rs D:Cqu0ېB*Vⰲ鞹Dwњ X0~SmQİQ3^5eIs_BP p/|n䰰m_5 @vY"GMU@h1yY/4M3%FC=[oԋwۧTL4& e<^/Mgjቊ`˘u8b|/Bu6*x0`MiOo7=zP~"6 Ir$%ߥ/7[zZhK|[L9z]*$W$牍Ы< ?uV?Ę\E0Q?^%)[ET hUqteuQzՒA*摘jGj2cNxaBP~8SPܜ0yOq fY8`o 䔻m~8"'qlxi2)Qw Z]v"*..ڥoxͱZ_GC=9DcŽ'1ϡt(|UH`S&pY8͓V!B0槲\e< .eʠnQW9diL|l׏!9)ɻ##0])+\7 e{qjXMGb*3p42>~C% U9up'vvVfEVkG ZQ(X!ȝk-TBFQHcf=5#phZ3+iUįB~!,_dzO{زV'sFcjY||C~-s#|u֑+3~T跓O>?0ç`2@TJuXq 0{K aIB -|(=iqs812K-CJ g&ޥE^8GY;{b )-a)LiHr6J '"B+'عFBƋVܪct#/g I2x;CmD@N//u\7Xu[&*Fg'4EںSoe,`ݪ`j)YLI0o"aOw$ /#&sgv:ﴠ q#8/Rn1fچ!$;W b0gӵ]O? .~cLhjКX<;{6LbqjOusk$SKDn}a,w-,Kp"Ϧ=jWFHv*+!]ࡘA#or[7y%#0@ pz\+?=nn3Ob4Qz-\$Otlҏ'PXiαI-``ä̕KLd p8p vV_GLmR~<"nl~gQAհ"➎[މ6gᜳi@ =/-XN s9bb|Sx (x,tLJ˖ݲBfN9'U'@}=(v#׀r5 M{<˱姇ٗz5hdHE=yaubK9\ґCa 5ΕUTcvIR<%g1˚fAty9Q } kc|+NFW&D,2ͳoEGz)LxڬeMxCN:idu)HԻ% Tj겄R0Gܼ`0wkƊ;rBn:[f~B$hu~>[uۼhy^FW`ǀ4zğU=$^TmclΡD%Z܆\FdLPlU2W\njRjwP+z2XmjOrtSHx_Vk&q} i&5rRe Ӡ}ewA&BS6J_Nsh4os;&ϽaB~9om a$ ylL13V~o#QLL+maU]'ȇt1(s@(I`>)%Ϙ|4s\sЄ(,{U8W<ٴkVY|wҭ(,y%jhXU2wlڔ>O)m'" ܚfd'1Ѥ}I{Bg,i(⎳EE!b;k [t =sܶعt` hD.-4>t~g>*I[،ˈ. ,[9m[|uAyϺx}$;ݹquC%P%pY׵иIuEp\Q)fLJ`zrawXt,W0y(gV r}ex&&{ ၫ0hfGr`xzf[T(E[*lUs|ԁC5@,$5xSe1r uP37oUVXO2!^zNӉM0ҧz"߅'QHV݂5S(D64݀$6`)0G3d),V5C!3iay YpZ*MlfdcP=Q@AHB}(gK9,^ 5x'_.Klk\740*Q۝<ɯ;p?] <8țW}MƳp⚺3R0 Z]Ew|M p*CͼSxBb$y;t裴Ϭ 9vHH4ܪ2cwyS,JR/Qt~u1aP[$T1b'/@6'nN2J>$eoXY`T]eFI5A!j z'4%`4 A/\Ի㍁B 20 , tLKқ|zNjbBH$yq7%Ϋi+}-ݨouֵnvh 6PZp}Ejs=4(ܿO(ܰ5ia|T.k>[RJ7ɧ~^-2T~6|fEgƻhsJ&JT.w "]##3A$,QG wzxlZO3r6P?WQa{Od#{Dnhcki@IhHy!Qw9k5' Nmi j 7bLGlZoNR覧[R? )uJ^/=G'ob0UP{}۩DJA;b1R>@SRCn i0$on] H1!/ w_/b,ظߚyH -<'dcXjkqlHGv+5}h5X^U<\ #C-I*b.mi&8E=ID !eEjۓ4. kyR?ͽtĖ ;):1*˳e19s o!i@:tJ ^M$LOJ]9dBk{Ua8WW}ZfјaMW[l=I{ѩջP>9ʍxd\Dqį=n,BNĨh%όOvX gP֭x?\ჱ[KA]GMT$%/xt&̤SsȀ%tF2ĝy2h 03\v7`s\.DŲ bQr쿩AJ0~IRjh2;PBIDfvVG9B j41Q|%{> 9Jź8k4=l(h:"PZ^9l0Fy1M|ɼƼڥc&*ۥv-g_5ٻ~E5_)_LNT(dCj/#2~䎪 UD2ߘoeo ;._Wici b۶E\EpͣZv^3Tă]j,L-/סı0vM`?)_?a,fni"a6| !Ē`Zh}.dg$IYM8ih8nSSPGɓ2{`|yM.x45k2I,]rP %u`";i-&Kƈm RDЮsqa0A_{)AD=Ѣɿ^EFBwX(҇"\*ֳUwpa)&@-nI`flkN9IBo8F=Ȼv+B\,*"G9PCjXs|bAij#}Zl!&h-6aFl0s &a,ZPNL0d֋ص4ѷB (q}?݆aKZp뤊6gStqںcrgժ"VDGӁ.q;U܈ɓ6Ap1.BxXlJF]e 0N {gḲ:PtnhtעJaج88$S$4/\{ÖT\S8!,V{d:WԱq?*<>_ٳc9^}"=RV\e5v>ÇOy]JFqFz0܋%f{Rׂ-AT7IdŞU=z7 ̞Z 4PjvI1e/+~kew~&] 2d*Zv?lŒ[ɛaB/'O0B,h=6v%u:g +/ BEGV϶RBa%8O7v Kl(bSJ;Y0,V$۳*8UAy( %au TR ~ȻJL+shvdH~©[ޕ {Uh.[}Lʀ:;"b rT_a M땈CvOh}+1^k$dχapS d$z1n#>`/Dj#.Cfe4;{{M ɝWK~d p'}lj'|e^ °'X X [bzҧ%{IJгF[4KFHx_)X81YtppZa[7lk*CmN'x ׉3, S1LpNXWNx*AEYǙb҃1@$0x5嶟g~Fh =ȷoTk}`.rnMF ^k|Q@ Xsi^SH8фGwMژ]a(TDnώd-" 6V{0ck!4O)"r@iD>7V-wc!OCTm74'&cLg8u#8,}˗GD cQaXOF L0EM+YhI!*.̅X wr-87رQ,.=64GL>PdӂF=xD>=w,W+t|Zݑ#awCo̷-)C!bLW־# O^F,@}n$Rr9TV.5]غY"YI'9NM*}v[\r=(sl_$d%;"Gyz#Pw8iuJEJ>_a _/99@cb1<PiבLϹcAS&ު vy0rG|a.*nutBX$om;ٲJrıgi)x{$b%xus3L8ͪ߭6QUlW 1wE:YtQDאD/Nb'\ɹ9xh$0aV6h]ʆBtI BW #TWX R"BMԐCw>,rʯZʤlb_(dij/Zo6kFyT\Xܙyi3KR9e<]R-l<8ŋPŃv '.ǡ$et%Kxf<ɲ( }rTY(i "ɷĉEEQ:f%"_IRRVBD$_(0؞cϼܙn-(IulJc=Ƌ#"PԓvVDnj%FU!'d_\UJ(^X|{Yä&aYGe8q$,΢ʐVָhۢB9V xVT")b{,I p< @i).5!7qً`?ըZ,d,}d6sWt7Rbrɓ@#J+aG[JT 3 C_1Nbf)|b7GȴAA3y*(㜢#Sohiq뽌cW'CT甇DrhL)n*c|Y߼ tҫ f{9_Q+QYn1V J͖m.\ ^?a=j/#YlFc}En!S9 `qZѣ;3+e-QV^@[&! ?*$`v-/O73}FULSLC|R~R9,MtROQJðFѩ!)RM 8l=Otڕn=h)؈ƀm9~b_>'NTtٝm$SO4`&(Ǘ<;U,lVe/8U8*;Nҩ61$KUK(nc}Fاy4Hɓ†7m+"*:[([HNg{l*`|j}ܔU֦iiE;a 8Ұ0 Q4dc]?FppM4+ OO!/AYƙ#寺LJTTB1o(j w? S֩AfvXHt3C?a&#ؽE Ksч^˲c`+5 cE~[ ,\ڥ`@FGDyD5:kNw{N9s6]]ϣH$J/P+cp$zH3e2e*t8{]|/%@N"Tcq̓ ?!LTEO==F3*G}COOgʵ`3!Z.][(L/"bX-ZSבeL 78ߐ׽X ;Yփ1pppDn)L$oUfW8VT{u^iWH_n./ Yvk*2x#?G96**e`Pn1ɪ4:Ȉ “S|!,s]l.(0}JG1&G7S,O4jBϖ6%8+ KHPreg^On/hi*^**GBXы5P߈as 4 d:KC~,tLc%6>,+￫ݗ75@]mVj1BNiVPD.i\ٌ,TӨxlt\~0ytx-؟ )H:@s}P S,&9l2z⾆=*E>!4'!^%Ŗ1Ud d#sGHJB_f($ۢH[ d{07w#Ov2d}TNs-d~yS+t *$nfCJ{)˚5xj::PU$9,ݍ`%v܌7)F㫣5"B6eڳMSUQkN ˛n{^1^ 86$2?"9lDG՝.7|86GN5yZȗ$BQwD@[@f F1wC)F=ua7, Fju>L*qԮ^Nz}Bwu ~xbÆ08N$`G+/,qh [ϴRe")d1Aۿ h#cr+o8Rbu>0cľbKcp'-&T-u{Ä')<.n UQn06!s-tpKiΏ,hcch,z,y3ƓndՇ^+IohyE@ TaaN㝐&rj3M2z9CPRr7V>~kH-%}y񕮨*@XȇYvmu(R(bY 5QL=omǺr_>"&ac K vFB:$wiUhu6ֺzr@xb"2!_3eu'du-I1^acM%8xA]&,TslwEY'}!SڧOfDEkX7WBT=ڀ0*z_fim̍Y6KJW.e\sϜИH>q+ VTf sPh67]@ j*H+_BJɭ눅VOn "UsW1$(-:_ F~0 bxae%$Da5DItK6؀I =Nt| fBwT2 s+ ;x*}B%-ѣBEn;uvR,ɇ:j4 [ čo2?ܱ|uCw>%'S|8&jcܮq14ĎY+ɻr')7(ﻑ +E)nT%]e6k~]+fY`5_xDځ'Y1Y&M@n/_׍(܋bFEVm~qlx_ LܰYլ}>0&MQǞ(ӬZNH4vJ'p\<^[u ]]QJdF HA4-N~+Q1 RjQ)\LCNtF$.Mcb{b3{?2C+-й/g WJiGLfB Vяg#BWGT?''TyMh0uwsy^ Z Oi󃶖炿ŇEZrb2T}o}ًK$ttIDd|3Y¯.esr~DV4MO8q{_?$Y9*a:=n6.YB~.Υ&=nv65>uvN" ^w PȈEJ\#ΏbOis(cj|:B\)ا/;GMo}N/mr?mbZ*vtl!bz+ʤ 25A؎_ĘGc Ե^&q˸LN<-SQ`Febrnڅ+f8R$&|$K(6p"p;`y;Xj9 [dQ1et{K} 9(F)MRA9׍a豀KCzG_;TΝzKIBgR|צFoq`u*ȄPpȊI7--~xϡ^{6ZNuF'nQGzd=rAʺT+zLZ?J#1vutud'2ʭÖߋ=wv*>D a4{Tv~AE?Ƶb 3[lFK? QHFvR4(E_DϿ= l7ݮl+`v06 6<ڀ/ z')F0U"qaGiRY?0N&~й Ȱǐ7A6 *M*;EyCW`p\2q Z55FR0 ez5ր4Jau sw J|:)N<}4 q,E6?.'M1]욘zI ]*ph* "[jTPV DqźhS]'V}O;撼T4, $hd)0:k3u@A[Tw}AXu( 'v2Bn<*Wݰp`%>p6y2t9G#/07w Z=急,FC~?KwqKn@OZڈV"]Pð0<k$ԀFi,ã?JГs4 0I6,cOѻe=FźȠWv*7ɟu%ooD7GP?}WYR~pj!މbB#lrcNg HmS=YcH0B1Ny%0\#nrs1 CXDo89._f`7np'v>x uv YۑBC#| ]y:Nx3>Bցy4ϏxP$!l\%~-ek Ur7) >CePy.XJz ~.꟬𩐲$*[j:dl.}fwH6|^Hp9P >]}g%q(3e{(Sװ0Jȱ4)CИ:!xxRa 8>q w~RhkR QEIפZEtaJn1m P鄳bVGݍJH{zjHQn&8p ôZkN}eOk `C]wqа2t ?܀.ZVFX˜e-AKqeY_AV|4MBU|-z: vsk!7I'.^WA5w s͑,"79jY""X^ ~f~GN/YJDӝ  pEB+tO>g:,zlub871E@R[6#kPAU-An ;2Zc)|lksm?F慵ִrD DeXM<Œ,:%l#b_[ŐH`*29HIBR;#:^yP\5M>42BSO܇ȳ#>هÒm c>B =Ŝ #}_MN4:Jf>D0z: CO ҂.,RN\ I8/~(^4Yp]\ȊDGkޓ|wlWqg+OUh<KU Z ə#[B߻_O^(MC \rJp݃P>֘GA0aQ|T"мpV")|%4MYɂ|}ч9g v"I7ZPL^6ɀ¿)V@So i6ZNm&_V`ɸL?iU=Yw75$U]]ahm)&%);{tqZӺ6~q,-o9 ;RI OSg4zjq5w3W"Tyw`:Ĕ&.\Zw. w|$(:3ַD{\妉L<=&o! e(i$L/SG0s*w+DnYZy$Y)};1Y$;1I8 _+j}4>~gͭa<9rQq ]Wp _KXk;e@&_0CK⽈W\Cb$alTiȅh31UwL w ĥ@mcyG[؎R\i ޟ3r}/s,P"8dOR0zvI3oAdQdpٽ):X#i`K#pB'>Oy?5/%K2!hbMkTe*\x0MX0z(),ѵ+~W1 &vbCX: ,Gk2z($;Y\D Ű_,(&CZӾdPShoSv):x>t 袤ٮn4 μ0~&mhI<\{5-k[e %ܭU@W2;KȌ% R$X262XRbuxM|գpD3ᴚ>U#_.E:1rCOq*#EZ#ؖ ]?!o[yp'~T#"96;<1);i'L՝EHFꓚ(:U_t)] w}1/ˍTGKY{j]kr+3GJОR- ԫ('aE/%7Ҭ&X:3c5&Q(G{}P .ah%a@!)҂g\HK6<<ۺl-_SC@%G=j_Ke1܄tةKV9.r]'JwecK}R/)aUsw"s(saHHhUq hzvl՘T*ռl?yOX-x\Sp_\|uŁp;[<02B62 BhO|?v.p߁škk&0cJ:~W*˩;QзN=8j bp/f O6\uNK(; bR^N9PSm)> /lq{̋ء&`,, f3zA9l h{g&' "aGtJQ>5.剝넶m2:]#g&3("HU7˞j._@>bT0uݕ4ROnKTE穠i@TJp\g$E鿧ڽdF@f]񽭂ʃL6ɀ̅D3zLJ Y«82I|vPH=^t'YkAs&\: "CT)鹍'O9KR uXALw^:r$ujyn$|O ),wf\tں ~dS8J`]% %[q,u0Lr .ξeXA^}jyU2V^n2ʼn&LMljuշήMmVazjM+䀑-ΑfO94oچkr.ں˽&W5aX~ Md#D'"=h7qSTh}q#Z-:Tp^v*ܑ=}/S~єN%2Zf6hyLe;XnJb[/GW9޳.,Ѣ%-kԧ@u}I*[$V >O)0OEsM UHr@1W\PBPW|`"aTg5T*[U1*Xb0o뗚xI m5GjoǪ};jaCjI::q$q%[gtA[f$*MCP tf"5rA,(A#60zd| w6zP:+01D:*ͲnÊlKuPJD, YZA_%-&$ai"oH(!D\HپHtl7$2KP]ɘZ%tw|(=3MM 3S"k΀uߡY:/HrcAη&B)A+{ȥw_`3]iM8WI2qq'8="A{D$V?4AB<=@*uN2'~\m?{y2MY5ȶRZXol B&1+=A`9kh>曳1d^ GYoSv,&ĿbC&hx\Iz5W~aBk042 ƏߞiJ5/_bcU7:[amL >Q@6/t񧽚< q=W܉z\x:yQ)ԋJ#POp-%A+fئѭ(<A" zjy)VQdaIՔ9?񄰉rnGp<p =C,`O䬅Nr',Yd\XT:TH\~' ʞ*@%WIoyD*N$i~kj,n"<#s+-9qA\^F'j<x(P>n6gvϋP0qǪfs7mt! B&fa!w V8̘?܋%ReLhN "F=3K:R,+0ĵ>_$Lc StC+"LKy{N!'o9bmz*#6Le<~%t*94c:wtaLCOwhJ#Ke&E ey|H[ ^m[O%}k?>PyFDBNe^*'4mc?oRxumF*mp6>r^h1یo+5)@XErwk$;QLJd~*IEa dfY['鉱[K뎓" 2N.&C C-eVqHȗ $y Xi?7͏VX?؝Qu+qH[Ijh;H k# ]aھwzni8W,R"8*Qg@Izny&nɧ+]_uҨ(;f7kR]Q=0"ջd/o7rNkovL[wn{5qz9P%}-C} !{ywو|k`v-hj" )FOW 2S0cDK- .C &"tu(v 0#̊;;g(\](9Z\ʉ(kvQMeŰW +`o?du~{ʝ}bܔ ]x{IS7M*14۩ LN[)dz!  ]ZwrD0/\8-w~msj"7gR'M' [ p*):7Q{(R4s8B L_ >*i9GѲf@祒ײ72 9ɇw.m(~‡i1]Bpe&X{s ZObzGш3b| {& Ǐa{Yꑅ7g0ڤlZ $B/odz#Ooސ~'AdVK9ɲ)jpZۗU-;t~d>d߸R0*/ ʴɓY.@-p(C8=+޺_X߻˨]P_AkAXLB>Ts.Z7`iŏht#n&/+9** x3~P5VMQ3 *{E9*)`;U5ws958a1Xv3"LԋN4uA~&'[l<poGSK]'Ӆv~XpzdƦv:Jt8ǀWxiة8MHe9egZjߨ,`Su.ۈ  (,2s_KCuj;߅YHZai1g4mZP30Nd1pPd=n*(X$ԵS/'/:6-[f"+FޗaIsj}{ͬx9Cjk4;.YǎC04,N'ya1㽋ip|oSӝ0硑C|h6 ^qIm-`Ͳb>z7xSceF5d[SE=sssl$O*9¢2a]LgUŽp/Z(Vfbo;YЈ}g)1/~L~I^Ϸ,KBhSA NLvcq4ҘUeRGxg,1]HM|y|\c.nTx%Ԩ5dlE3O,Q#esF |o5ŭޅ pP-m1LV;QJ~x{U鰁)pD`~m/~z8P!Q~/{zJ߭L\Dyz#ӥʈ?{d%kiZZ$Hhwsu4jy(ݕsnZO|d10uГ@@}[{g_S']]~2O3{0c}g&0{^* ).73͉:]=4oV r@a1>\-хs*`~V( ( ~k]"4ݯ/)Nkq%^7*% '"?JÑ)'gPga 2ϸI~Q<ˑը&XڧjgއO٣2.s۵dAZnSxeYD$xLvF> ֢afH| U۰HrC"y#OE57#88Lh%hhrߞaRIV{ tpkZ~075TFzjES4AcM&Oq~+L馱BkD/.֙-c"6;}Q%/q&P Qe@R)u[֑xvpTE9'P`0|azM&͊MDm%~9@M*b:Mj |=±z (sM9$2@ycD * QE1!%_ZC#9+s^ Mdq*i.J!=E%]xv(|bz<=\(7uƐjd|ʌDtH QڻQ**LO7Tsp W:Y&ƤkRtן80~P 8 Ʌ-ء~΁݃}O](yP|۴ZΚ>}/~+`98}<譎~ah-˵9t9l5um3>5&}:G,)Ӕ%ȵq=B=W${0~FBcB;}ocsc#l9Uއ4kSY7f-M2h1Ʒ9IB"&4-N=Q}leVj}䧚~^>~9*l7e(/ODե=I1nj$A j\646tvcWFi'(87 B+;;3ʺ>*Ll+GA'jAX(/c5vfʓI 65t=Gw\t Xוq}Lfͽ=p wt8dIBY š2?#w[فash`E(S䎡*!)%<k Ccëm-me \-f2-]Dt8 gԲ{V4ҿB> ,Ϣ!Di^# =W hwbޏ`ib=1/.z_."!jo1VQuՖ{OXvqxp& 3@UNzpcK2x>gq\S!FV(?3Sniz˙I$0wlx-ɅTpQwuڳWJ/[5y^KimS=wIIHimʛ4h=q~ mab5m.[1,T~vCU_BrQ?j`DR;!2dMߠ;Iljp!rts᠐罽iwU|{E'ÛZŹ\= e)w\p@B| .?Lҭx6A)X. !A@ujrN^\oh# d#]HcF>E:z~Ag(h*Rz jx7-[؝POS 4#;: rOr[dvnC>RXkir#Jp"PX-PcŬ0;5m()׹|%*I9nb+.TpZK3f)V`iY ЦX2,HeQ|h<#C~˂'мS'8v=^듟#U^̊@m70kqC?eKފ15\j!K}`lkurE0!`ϋ^hnxBsimwUd'1Wr^ƌ̝T:)j>4db%L3.Q=a܃ rl V$u%II|X 0tNr' >̝㳐+d$QA3_k_D2 S Yۂ㭩@ 70dA_!2gQaZ:*{OS5PCңT_~b\l|ci[b?Ue{wshG+X|{z~K]vz|m/,.882 >MHZNB;1e|Wݮg |5Gyː$gro%<ғ!H7Ĉ8F=i3ͭ[qA7_:? EP@>?;3k藞_H5dz- )6\`G95~ͪq 3ˇzTу0)V[Q QFRqhl=L*GWŶ q?͢|@4,]yQЉ'H*y XpST|EoN]M|Yv'P1[m(n.ޔ7~W`SV4^Cg˽%(/F2{ΌXׁTV 0ێgr!7fԣhg#:(]W t 81ue~ʯLxO{JJ V[!W~c%7 !n`lE]؋S;BͧUePخ>5 x31Pui0ݭM,1Cv$.مHvRw"4h;+Yb0S2ȼEwA?wrr V߽ /4Ioǔ,[5 9Ų1ͭlKXߜX TOZg11Hµ9 3` ARm@ԄM^y5:sn;4ښ2Og *X(xc JKN=վ ?ڎBpȐfNFG+,J^h7J)|qn^v502n9i)d+|2?vU($wuO,C$U@ߙ]8cN*[$ eg! yI@ ].'gnaV"'O?Bz6s,c*7XTw7ZP(2Q&{P ,)+y D\0t(*yqcOTM( b˹P3Tc'fP7tw 9\QHu`BT K5:Rz<͉j: ܵt3\Sw@]#g }.C+H/ #nhg[\$["]|&r{cJ+ FU%ϛPǃ]rT,8}Ԟa^ Ïٍ׍0H i9 0LKb1bU{B#*I7tV$Luil:QRa!b]j*hP$: ^'/Rk_ުxDX(1e#x~3xd}#Oc{__lkh&;Gsa;9!Qum,"oA ZuÄnmgO0mV2 KvKGNj/Qص񖱛2uE@Ϝq5Y\gfY6cGYOXؒL+I:%{7X0ZKYdG''eXb#-;uj mu&5[in/$B O#=MюA) p)am1K6x0p\x%~aK=56B%IOʊ6G=d 0fvhSKG8HYvPeJJEN g( (RO.3w2*+u3+LR[r#Rlog}]NֆO Yyȷoq|Q)ߗtĆ+S)te˼*4!fv*A(ukEiYšbѝTFWjmJ@E P7tzpPҜvÙ.Zݽ7>hy`WQo:\qQ"^X\ӻkzJKmH'r͸C-P~Wݸͻ/MKţ ]CQpU!WLtl b'8>!2x֯+Zttb6[XxڡFPz5TEBSih!i=0΅96kTE'C^/ !*"yN*4]2Wz#7"U> ĺ*0'JX'nd3*$l&jPyd}\__#'z oJlI)Fcւ(Nr͠EC4Vj~2yJOe.ыHڏ;Mډn mщ5`?97T[ؿՂrl.)ׂGW4 @dģ^ΕKrnDr Q9 VKObAzŠmBNޣ|c|{0҃]AH I6|'N?b"  L%}˼avQ#ޟߪޅb)XȻrW;dkhHFn7[$&pv@'//3f jITk"pS}`"̇ωn!:ܯ {H ,tAch[͙cbcvԯzZs?^m"ksn2 Y2%n{Dh+LOZRfA?/AMƻ81=DVWH9(xQ:-cmV̲a:7浖C~&%[נuHh>xҦL5-|Uo[}aqbK#S#٩vv|[׼4}ꓹ\f̣Rqr4QXrOOS: rZ$Ͱ ~Kd̚Kg[?,z^i 鹹;hcA"Gc"3>gٌة3[Js8O8%W9>QDq Em4=U w0d)>%߀Nt.s6cI $7K$F5 C:T~HHh8NwCOA P+XBY + w'ըl :z G&՛<뱜LVtiyeQMF"a r' :=Cq33uJ涛eiڳ֝$ݯzD!尘uϹmb']YtNU\gcm{58`L/H3uA(-:Etʢ:ӸPPByP(ET jh{q]/7Xk!w#Jaѻ$tD/zGTߨYztrm|3:"io"(V$eJyWhS ca}-)nUs|Yyk!/`=O`tB)Mܩ[0H0LB} y :,{}?E$g3=Ւ|9k^p5#6Y\8z"H (7iPnX`N-ēFbd1Iԡ~nܧ:sYd`xǽ&dUp,Tu}hY*EUpgY/Y@o"9J鮘'Y;¡0̣de6\Q5UX. u$ܗn& !ےi AYՋ}2QU{0y HL+?ռP9^K~00}NCuMWY( w!?C ]·t(TjCj{7ThڥuuʦwB'cPM1ΆIab@bܚK1jp/1}0?f3mGTLe0gp8Ը}m5ۀcy$h+uB6!U;0:-2RkŹ>xЖ]Dg B9 Hdh7W./zzz}߁3{mW6/_/'W ,f@'WeK#" ǽԓH+4 [bɀvtlѴ?RXs^x:|y[@@#lXk ?t|3I^(0mi1z7_BKH;TQ`]"D"w2 %B[(g)aJۜ{ºgI7A&sPogJ',Z0rp2VY)S=I_P )1kBÄa%1Ŏ."O^sJ8^VsיVZ/3J 9mIZO?lv/(2k=K%Y VreYzVw_0%Uyuv:X#xQ}r-F|=I|rbh'bVPd_5. 멣_wCA[bm2p">#7kæb8fEd%eU0LS2+{3*V@~y9!KѰ* 1j?k$jZ { bz;@ E N Pc g*PG,5೔&d a_4jal R=G][[pw44ńATxpl*c2Fk[g~?b^ UZd9}PXzQ WYHy~gKRf/ecvȂ?mCOpυvf~ [OE;VwY9'O&֖"wdY>2Nf TMSoTܼϫy R9)JZgGiY_XKY(mz#m{Q>r (b{ 紌BL:`?\٧BuxJ=]9amGRPF.kƘT1lY#dfm0I? =êhCX MHjY&0p󗽏C^D1T1V><dP9ì=f ?NjY4^SDY`,}S\q ifU0}9u`ע/-q|.Ҫj\SΐV3o(67ޱ#NFѳyiQУt(GfNEI~@>,">MO "|PmsBm;Cd7= =pGOUWnjе\=-_m db^;/4B\ fvUU_m*q+ޏy3×lM Xh5MP%^ u9̝qMWbiNjMYcրb;yuLg@y. GD2{h́K5W^ 7~v 6U2dw#7 MhR<$]2!c "5*J|e6I^tMUMK] !f8lGCq3C]M;K]fsnmn@ g5:fͨ\. G͕rD.ibQ((xgT3u{f齭_gQLlM7-34"C3= 5#0y֮{~$vcɼFZc$3)M)jzˁhSrܚR؆\ː; C4:wTZ?Jd^c_,Gu0$ZD ގM5KJiiK=*RC[ LP-6D]QB1j(ː^tikGX4*jp΢r 峩=<(G.#ւyL#Hv 7g$+B~9M WᆅLJF5BȽB +翢|{=޳@'r0 ߿rbH3M-9t9tWY ]pؾGΜ9x'ag- eVXb\lZ0Pp)b@yW/FG* ;]eϥ&@ILIl\[.QX;DGt}gmEȻv:l{4ͯM^TgC\׭ڣ׃}:=.oBι4Ƃ+  ]2e1I|UHmgSJ>6}rv8=!5s}|5m7C~qŦ>@ϙ!!Snclm@hV9X`&6õNOR ހ2Am g.ĭ0 ۉ=YȢqኞvZCܒ°,!]OpNmc٢MN XqqPIױ{~F ~߭o#~E#JYXᥥ 韊x5al./l"04'+0Y>ۗƟMj 0&DZW1U,[J@8e}T[,7pA7ͪsorg{7$YOb٬vSUγmzMB덏b2Q^ʛ*7HVWZ0<5`}_FevQ{ޭa$tdl9ߞKy?D aWSma"cm$quD_8>ʼS "nfgip1rp@4CҙèBDl)ƵrU3#|t\da Hr !%V2q+m-|DltH:Vg*҇>M3#B_t'S(CXI5/,ۮᒻšޒ2EWƺ,y==pc btnڹ_nm`C~LS{Gg:iƾ)-()RYaAӋ{Z2&PzL:_MBM"8tU[k7*HiC1Z12"hp'?Y4^ˇ眷P\4]˛JbG24EY5Af{ň .Q@_B:(#,'a?* 0tN yv ~dE?rZ%!,=Χ* ?]Zw3ɯ,9h+("C`VA$Kf Z^tr:(gEsJHlu}T͕% -AK @:)`S_>TFHVRLV~6Kf$ bs17qR' U] ) ;%,E-ߛ- ^ΑwƼ)ّyQd+O tyQR~64{/0՗ǯ [O+/A{Nf\Enq d1ao?^cݸ@Lb䈤IdB}n{1 ˦k@Wi9DW4'T>FwUu$ ҅S4:4rcQ΄6ѣCY{ύ.^K񠕌Lu+;SLA*1e7a@H2uC]drR1nVEn5ZjT^# Oul$lG0f_WY+Fx* غ, ;tP%0RͻȿBy_1ho)6ߜݣNEPid7cEqQq,Bެ\ѫ|itco]kMFI-(JI4FnyVulKZZwS\zL0H+0Gd}~z@!",g/gy EfsHDkH*qZ9$$?Pv FEe[t\/6]BG788ٗ>y4&#Gzu#Q"mkYU\wu"TGK"U+8@ڛCs[R҈׻({}fq:zGplnYMJ9! ٸ#f%3)PFwj >S8Hgߞڜ?t^6#*jڧUQ%Y_cȎőcxz1an0_NvMӡV/M,YA6>TVWvc3М)mU?be(٫N^^~q?pB[k6H 6TE;A’zOBgDIoȾ6Ѳd5HR:Jɤtfŏ6M&#ZӻgT)1 L0)E>_!.Ġ#'3l>H$9i ?c69Dwuwkۖ(K~k9 4HUze#g#}vUb{$+:WrqW,¬1h $</kɘ-ApA.F\50p "9hJ,G8 hߝA+}'h#udF L_/;LQhzU/~-YRqu8n/[xncWc`x؄7a؆.!NUwvs;gz5zE}(/%تH(M*0UV#f%'sc~T43ftb`io&G533~IG cRuP  $o'$5K- T/O%X8V)/BF;o鄀ͧQ? wј%_y'Iߒc8[aeYC@ [Z~"#Gh6LdL^x:}3 c؉)oܪUeVJ{2ʈF3?o. %|-[5\5%Rwx~qdOfuIUųAIn,X #LO}vD3/#qYg>DU^"Z#o?o|g&FݪdrNCi͸5!NY@cDnE*ېZJ8Hxmpe8掺S"l{0-B).'@ݱKS19,_oEлCWQ}*rOfbF]ʓ)-mdJG,j-%v6~kA%c)9tcoNm6Sll"Wk3 <q757?V.D|J b ܇8B 6h 7XRn)6(L}hc3"լm!% +\|viᷔ0dExKU p`&co?8lACFXur5Eo27UAG;OmXY6XEpݼn$:qߊ^®&в-g=wƅsBpXMjX:] Oh3^uuپ JAꂓlD06`]W^/TKHSyT?1>Ȅ us%fЦ.kc%-X˒i{PܰƁlrݱ"ͥlu޼%񁊘b\vG.!#B9P-JP\w 'vLq7nEOrjRKʇSmt]*&u% ZT۱nt{l "D֐Sjً@ѝ|nN&wz% " =?-?Aѐ@Ow`$[R* Mgسx&o۰k &ⷂ:_pPWrG/!8 "=92/m-˴郖]u []gw/Q0%Q⚺4< L#[`I5}mRUIy#eF|K'%//6J>H/1 yR)yGPc$]aj(ʉ?9 ź5BZ,&ƀ*xuQ =~J;A s_d@3 S0|z]J^^;PC|cSu!.YHI'=X\dH>P %=tit[c &XgsA2q7>"ǽ 3HLr@'a,X1۸ Ryu[Õ&dp:l w<`T-ɣGϩybSu{S@Fs+2NhsMh>uGTCc-#26Vp.Ǽt@6 ASp9ߖ7^,D]]IYȐR |cJ. :ب|hT:Pq&q.lZ TJ3o9DXK_#e7Ǡ4.zMX77*J7) /BC<.5/]rl>Mh2T)=M .l76h\;Dmo+`JN\o5[dLm{P怈0&37 !SO?% Ws/Zϱ: &Y0 ҥ0*oy]v :Qv^;q9T_6o׫yT\$37 \T7aYi S.נ(`=_yO}G+o٨4@!]Ȳ(U}ף1B(6T]1 .BKKۜ|*[ T(.+Ko?bG՘+f.mwT+]HCOA{/ zmz {6skc2U pc{\ jj.x2uEжo 鬽T'!8+@Ju >xXI+{dz'-z#k c! 0X,n@ |#E};mⰺ滸$,44⎼+T)̥f1S;(8 O7Ɲ ڲHjg)Mґ~3JJ6}7|B-}G^g{TZa4`*W#zYl{^3bS8븐qrn) r~mM]5 OG!|lk:`ArGm\ tC C*ģ  }d! -zWҟ?Sku&#)NJ.K~HjOu=8e0½4+9q qg2Za*p9Ia`aJ0hR26\eҽHͮMzήl"\!ÁF]7u8rvg06&a%V؆O }b׼t:۵@JsTFqϙ ]`2Iǎķ㪰jx?B=):q߶Ago*}L3 *U}^GGSaz Ie&}Q!d Ѡ~Y:( dQug($1wv2ϨEž;vay5i %}~cmi3jF["mRKs[7Z=Ѥ;|9=! 'A*sN#\#R*u iH@2ճI!oB60 @ɴ~uJVvouWNQmt69wt{BR(=<_ET`k~Sw$W tM C- BGқ0$Rd[QFQJ5ߌ7% IgMYLZя5? w|ho/dwK#sh!KAy8h`V 0ݤ5d ͼA^ݖ,#3lHor7 "$st<_FQbV Z"a'<"q;aku7r%(H)$[X>:AmVE(VY T!M/S%o^ EޞcHar_t"X b uBUJQ[?QVS2JW Uj5`VGL'_[ *[ζ q?SŤ~NZO5H[5#Q?f!3܄lq~d5AiI2"x 4xBZ  '^7< w?9THү]SIyl;XGEݥ+%TRoϒ"ў8 F9X+"jd%.o41wݘ ydxNxudv̼Nw-=82qZ {Df^Y>+ $ڈPzh/w{ i>(Fl:A!P/Vg˷F՝ k5C{SS?,@&*׷4TBJ> Aг"i%< p&I_ֻ$/mQG7-TsMƑdN|{Sq$@WzBr,3Xy%1]$Th 5!yPbP ; ü?iv>d53g"_@MȇY[Bw;pVK:+]ptJdcӥF%J 'iGPe(o c`f>hETm15z||3C,';F43pcGB7NA N4 4>59J14(+Ȍ:3r_*AǴ-$[vLPO t9h:kuKhlg dNҙ)@'?hh[_{!+SMxS^@)f {Z]STq!'X%t~@-ˣAOFB0@6vC ;՞'i6nGF! ;Ţ]IejO~>zἂTh|Vn {'e OB+]\ד~|eÛ ۽6_31TZd/N.]T,"&>1=ܟ\7X"`Q;h+O|$QZkePH Jf⇚$6{bUb 4eSF筜N߬hٞCḄCe{J֑^PW%I*w1f(lrMJ0z(\nW:&Hb6ir2Z!3L.XvB75vv @qC 爒ZmXgC(C1 {w-~yْ/uHքmQ0?\/t,)@4fJoLu͂jH(C0Y[ػ0F Fu%]_Hkqq?r&0wa`]$ITDSt)]2.ЄD!waFe%اoM=Uk B $A="w~2.Lnwp"difd+>,/B)d\+N9q i\nH4sa,,D'hУ PEQ ?ǔ;T߄aLN{_Q_xMEVvD n2? dCbU@ae(;Z̲DfE+:lIt7*[1BE*Ԡ=n=U DI:T%U}%@4`ۆĕ^u0f(>6˩};0ZlJ ]A?qYi*ł4<~^^<7xwR+UN໣; [|lpݺXߐ5s+{3P|`mATr$IНzJ5Eeӽ̶Þ iqK2s@ɷ[^7eôo|̍X| D  x@@Hcʟa>W}IdO6v#aL,)]'u-ºݫ*#! ٧&uUsR łߐ E9 F\-sH217#I\|{?W(jHY3b۫9 f7D?<Ĝ)֥^) ֎ rQ %kvy1ueϞg@3H%+I V Q*;趣y#ڐ{݆uF5~֫!i#%ՠɍپ7#jMOHܰKAՃ 陞XÖb/Ե,@l&uQyhT\dcvSN)GtN>F9\sXA*s$f:L N$3Id9@/[I7ۓ3IHV["% .DY欍@ZL:h@U^Cvs>!vO=9T5bxjFd5]w.sZ^|]>OG [Рl*/ Zpb.Z OmR0a8+Ч9X4%H B{dNfW܍DPȋvxV]l>3^a#ECDO ҫ4.e-Y}/V5rpҩ^Z 0R _ge 8վ]2u;".Z^d HWc떹~yhXSDwXWҡqJ}tD8"_o@*PsȉݯQ/ AlY6l!Wm`$WTTbY8O!Bk YOLh@k۠uO)(%'I3#rlزV74tΣ1 (+al9h0#Qq}Z)ʗӹwDG, s.>C?0{;.Wx/mw52T^V+\dMڷ12 i\*GMӥtX66ؽeU![,FxaWymDaA2=xܘW"m{{.45U0?./a~r<=z7~( ތM,zj`nѹ/yvZbOO| GȻeE7k>gܡK$G@vb#?vj z$AKDz\Dp,*DU"zƨr9sRw^8~? >h6fj0>{%`ș%VJ#z mYTQƽN1@Udjw=duiOU!u2 Hu'Oc2ɋJQPe0J#A}*g U{V${szg|FYe0a aF?!JL7~htFΉ T4N"+:΅:4n#+vO"nU˕&-^٬խ;Z)jDJɉ,bko Ȋ>=ᙿ,Jq#Y~=a'7]O^RT(j&8Q>>f -2~vvKkłze;=9s0F;T(O9>Kⴃ傣uР#[|vDs:tcD'BXIpŠzc/ pOy}z4MVjD(e U/%ߘyh)IB jw> z^/9ʕcoT:MڦcSm"@wؤ|;NJ br8#0mTOt*^66_{ٴz{z={(NAi*=XZCy5cӁ'uviLn" 4cjڡ91Wޞ˾-2,$Hc\̿gE/;Q Mx%{xM5W XLRSC./@>Rtvuzla:Q4Q/(CwvY8Ԏ J`*d荣ª%³1 ۃǾ<d1[{yg*-y ({&О8s.xW)$ʸ\`~i֜geq2Vf<}'WCZv ʽ 9MtK…>Z?f;XNJ< {P>c/ީ~_] 0.L_j2 dbpHI-vͲIfE1)h}F+-IER~7Zte]/Jvcɞ&cQXa^R;@ȤNhu t[:3c&fB6BHJ!JFJ#]lEEiuf.Xy {Լz|XaL 9ieR QpvRS)m;T@|{%o4TIel©_Ȅ~82/G'hrM-]bqϰpm:B5V_l `Lڐb`+Z $h^ asfp"vVظO<`^öЌ_Z1}N<3ٱrzˍOOvHEf/(%Z 02v|JVVM^'2ߢU"&7?,=؋@s_Ǝ$]Ɵ]<V/۴tgo9=%6֏#Jײ֐8ߒ7Α+-\H). d5֦}ˆ%)c'ځrx{++)YEǖe[ƓRxS^i'h8=[ S@\#L˷~@ftqh^]cak}~uO3s-zPX%&w4VJwM+|wr#]qcZnƚ|'BB֫p$/LU%0fbEUU:ƭ2LDL*E3,?+&@ޒy󎺦^4dp==$4 ewOwAC^V`3*l&ߕщSoʤ#>l9 j>%d9RK)wg*$ʕ3R-hϥ*A|}!c@x`O3;\XRN{YR#I@is-T1r p ]<ظv=GirU}BZZ4#ъ,/pamrʂz{`NbKkK`{yɣkdV&`K<1ޒ,DgܪׇͽLXU-$|ne/;leԮ|g"##'/@!zsXFרluqm ֮1 Lavjv*ظv뜩-'D"7fLfe6|.g_lwlAWΡ?uOHk`̳ w*f(Qy\RGy+!F6]2b0 th.BD K,{oȄ.aKt15kwQ礓ҠT9&5}mee3F=.`Ϛ_!ȇ17ʝ`յ\`3˖X;FzkKfH\e ϣ] a߽ v3|NBaD] c ~~}`=ܖQ.%<`&oڎS]XaNŒ9JHᒴU)+m~K=)/hkHdItZ%u+V9ޚܴ/DGuJR4]BjYY&GZIqʳ[5tt)cq؃l݉QyUh61;ѴY:jgj2~Jiϫ Um7:mS#G|H4^ΐfK"z}YCZM\UաR[@Fq>SSH]0ehRQ,w"C -($e\d{r翋J*/zgRu"$[IEњM=[{kd¶)L pRŪk6e=B)ʍY='wMh?}NQѶYȞ=]5( 8w)r KccI#_6Hzq^JB_Ǡ#6D6`QelJ+nGJpWsx=Nx7Ru^i|ܵG[>ߊ49Nqǚ 8+{%&wύ6pb/3ۈZ4&-T);ZOA(XרATM^I=HXS{[Oܧ5GYDv36g" a,^" wv|ڻY8*L7JZiV4!q]ώP7֑fjLfK5BHCIYnτe}P{ENˈKaxZԦzf,m 0cfs26lTaۓ]3֛%MLXJQcqŬAhNԟ'Yp0HRl*(afg+MC}IZMws! ~1gx+#;陠{?h|SB!(-͉dh°LӠ} jꜦ2N?u.zj1>|5P>\ɚ$3L٥Z`_E$Q3+k4I??$DISH^㲉p$,P\V[|ćb.E Ggr0E?uQCYʟJK$c+ J58lPc-bЪ SJuPϷda b-R\"c *ߩ/KKRWfK(4Jr^ WQp~Rn*N*«U: Y8gn}I+t/ i6[A1jG.®Qc+5;ZYm&bjB,y" @ԓ )an@@mV:%Jj凍;]lٯn;UI #I=#ↇ"2l̥|u)Jk%P!B>C!SqU~saMTV}X#h qo*[aAƆC zHWk( ,ƘK6X\ot.tޝL"b7/h@Il}*v+sn#jL%G-b_2Йb.*WƳwάVwtg˝UY!@\ N1H|CBsF ]'HbSBN*u#~#S&\Х7?ON4Opd_VM,'z'XELHl*.Fy-]XXo{[ˣ$o>.4]x^aR:ij]z!#YdLSUm)/`{GFb.[S[\w:dcAߍї8{`TBoV4i1z5SV)Yj 3'cw',_ER"/ֺ9\4F I犣{8'<53pYx=gC0ya6ӨNu\^DAzARTR1<.11tkާHϼ?u.iʣt.~.#_|5B{6+%4\d:׬&hYfv-Sh떄&bq"ǘBj*-^= >=q0GTuTey};,G2`t͇J]tP~q@R9B:S2.ĺˏ.])trKjlV(3XeLBܠ^"(m%9jQ˰" -^sPD#{BiF?<1&ǠZC}L+:b@;Bȉ{hԐ i]7X6xGAK[s+0KhD.6'p12Ƚ(//V-ed8ӟK~]A.Rz}DZT:zzkQw1x"2.I#vg9͐ 6$( VCq$q'8G&7ڶT8~հ ƥA$ D^\'^8"!"g-/VDL>V "f:P~$K&geX&P5y=ߧE, -2??-8q5j#5=ƛ:|GjLzZ)+/[o0xkb3(…>=i,mWL ;GW$b>}TX.#/8}rr,.kC־L)D_̡BB×; ;U\rI]GuGiSgiң%l926Np-$wХd Q&w'ӂŎ=!o-rE^mx"ױUݍiWݰXFɡDXyrGBJ#@P 3jHJ´/ @m9œ-'mN$r);d"2]rg!Ƶ?h"W„\d T޸t#1~3G,/N27+ z9Yl) \au4J)|Q(ɋ.Ln w\#`\)eUK5?VgI@'6ǥb5Iy#upJ)2 h=ch&'na<#ALyBa^9;MF`a(uy}܍}=Ak:p4=j^J3%7ʩ!HW 2~WHat02`וs3#>S]NLNR|ǏeGbўaG=T: f<$ :ɍ|y=MI=XDeQ7p#v("׵`ź;Wuv&|2پL(~$+{V551ծ Í{w6U9yP/f*RZ# ]hSaenV2hj!{$+}|ʭK+Xufc7MG9T(4"-iY#ױtG6)-sV]ڷ=MΈb#&%k9ϻTj-&NҾSٌ5iEJQh3,oH3PJc}[)I2ku⡔<yAedANp"u#°-̏M>YGCE.M=,پAQ&_+L=]cQ!{|ux{R?RAȘ,`*M=Zjq(DdWWȄ羐T=v}d3|YA!wo]l&^w[s4 4YB O7S6()3 a(QOJ/,!AZ3K? ۾Vٙi_f + X1-&E0B/|>\݅$Tp'v'`c<qwZ"pKl9*s[9WZ^]b\}(aqc 7`yXjAM! )xueʴi (Ynz{;Gyl͞6a,՛"$wt>=LgeìXlFߧ0ނQmw&}*pW8axbE 8Ym-tӧYS72]4gi$RBP~WXPcnwd2ە8GBY~fA #Xu&WQ-WOG!=|;՘#koKW뢔1}HѩC"izb^ea.btC8BA?3u ^Ṳ* K&) 2}3@kv}(cw4 hVצ~(9/a" /jId!πhwQt WrJ\zjչ^ mξ-I!6+ps~6T*-Ve˨pi=9⟘ =`VCeb42-6Ajo#"D;תtffZ:@y"h͛`}&XI$U=~M-AT g4xl\7Z{Yp1ѣn-(pڂI--Ks(`FCr. @*:Ib,Spџ?&8;'ջpdx h矍wjU`Ÿ{JcqVVu5TC =kP*? ݜpEsFthC۪Y~Ju#-9=]Jxr'f9zTwLdG͏RfauMabal KDwp4Z:4:t4cvOHDf$`ZqC,TړAwjw+=WBBtgtuѺgd{q ׉=$yeFdݼ"8əf8FfO8Vb2%,(6D`}Shwdb[p%~oZ:`荏,2i%r<[C g淞]~yGT5|,b[A49hC%|!Al6=(F Ē[/7W U" N %Br:uݎ^%hj熒n} xtӽֳl4Cd?"8b:)t !&<$.78#f#%dY mZaNN݅&?_#ރLxa 7 h :pe>VY4#Sؖ|nT.@vNbT9.2Rt7܏;A$s4AAQj42'<D\%FrֈqP"6 h3kʿm6Zon:jil- L%D>,{҇󶣓␀]!AE @ d igvȴD;eοs'_˨W~gF. S5rog١R{H5ℳ`D?h*##IY EQMd4A@TAah9#vO ݋803kq+n)B^w-&[28d. *i=xS,5+u1qPn8trP oM}Ԃ*&_wf)˔Q9 d$jӋR|OxǹM)S B ~?etF [j W)'Awd_Յο0`8 D7ć׳)lΝ{gӗE+ ROƁKip: -(g2 -Cꦕ` &*}{Cqˇ ㎷ɠIJ. <۸o4ױۘ1T֓&x/Ǎ5ʑ9͊_O!v&yZvVW o#s=RxE}1Bt|`s{ +6zv=n`ئKcZW'GuT1odE.@49hM- )쑾z9‘;tvPﱆ(Jy~ ^4~sFHNƐ374o7B1=U)gT =G-}ƽ-zbv΀Js)*ǎ æMe-ո|E.Aրs1^tJ>\)EqʋY̔ ĭ#NRb |s2Иyꕖ&+QV)8WI#'*t_t/PFKߍftsvkg 7 hgu+۷HzrWt|waYPF Pm}w}O'$fZ(Yˆp[J|Ezb[Z irq7\ (ޡ[R F91gcD~y+ca052b燶*8e8 T<>gO1|l#>qa$I`tf#-ǒlaDyLvR9ǩgW^a vHE$sΐ8W]aTMkt} -H@glyT8.))"`-]"B3.qg7 ,[ EW̔~&N8b%&,pEB+ekP=uI3U}^u4'A V9"|߬q=ιb["*-¹<ة.3MX[,xY7c8yt~WjNsvZt=g7EB25F> bR.HLzjzBBb&?\ &! uhw6O]Mo_bÞW(gqˢӾ\ɬ"WJ`{>'TJq4+|3%qT/c"%5;(y2e9dCC, 27ad- A2 -Cl' 8yA7Ězt򉅔y X6ε&+ <['XJwMOV,N$2,D,aW0p 0;pQ<[踖tg\o%IfLc4S}6=KQ,lG鄘d(bp-r(A* T ~͠3Ul+K78%=*2w[::qeb\<i&%Ń{4[@j2ʲ`5wJ*:3!@Q!9KFvOr׈j‡5z%/֟ooxi=kPHEm?1"sP]z ]/S#_$՞hٺ+AnU Es`_1vAbЏcEg{ [~KY1 =yzVmW-oܔ2_Uߦj#=Z" sOkxLB{M=,4-f.R/?ӹ3x낮KKS:Do(x>"?085 *s>O76bQ ଟ|xW9^VQap?bIr(||Au~nn;a琖.bf(pp aeG P0r/Z{V_ڻ">lACHs9S˔&`CC}ʭDpu!&#kо3EW&BEkF+ƔsH{>ǿfS'ye=8- ~|L{#;n4ݶaMCE"BqO;^*V]1uMSipSQTEHR3>#2, .{2.G1ѷSkɴ&b![tf*:M7*v*(/"6r p3`&+!Ap6p:^hN0gea0S<=p{yw S k16f](AdL$J;s&zX蟲\h;VǷ#_oa@IJM:+掦gWn)0w9l<*AepsSL`zA<`}lD #731}ָZ֠*~hq;evϲux8qCJFm#dfŔ9N;sP* #Z{)Y%.۳]eaHv/)Zc_b@4Df+sM@hbh2o)ņ޳r< ޢTgm6P/ˎm`h:9$XdE+WoPܯI 윬J/f2cigjIc.O$ck77mк"MX`2E)_!R*&fkGa`Tv5h=g5`p߆NGiµ]LkO XNoupOy}XB^y'YL[rU6J:V_s&<5to>Oh}Wq˹e.;+2Dag(HF05NŒOlnpNMe- .3=pܽ\ هܼ3Oka)Q5>2P9(7!6z8`dHZ3󕦩aWoG L5 <u3ՙ$DjJُ ]K͖VȨ>!(^N}jRmwMv}1L D4׻5|FoQ]B ,qDŽNciեD42`/e[. Rp f]gwp ʂV斆TLփ8iCRT/%=Q )>/:*B O@J秬= X ؟h]2b 4(=.^ʮZ5Hx?þ4Ӫ1z_A5%$PW3Mq-}-Vu]BNW߀\QQ>n;jFAdtQ76\83VAQkh>ϋ٫c,DԊhG= K%7<ݎ091Q~VnihngDUrmh$`RkO2ljG^9nEl] &݀<V@kq}ɿ9"e\Tpn膌ÈOd$mt)Ks(š{\Wl{_N|ErfCQ:@j֗aK{.9F7?]]]l˶QeV~b>'gS:y30Z:_$H~)]o31wv~5F5rJzvg":ZV8p+I-3:y-eZ9[rGb3R:&r1zJ^*XVmzpiFԵT>31|Ae=A-.$:֟e'+bRX7WzS쬬𢡄Mwq&d~pUUtL ̕q{t$|\~ wZ(go.weמY:ٷ'z Y=a8< V3`-KCsLuZC(=[g+!W!fA@X,D0a!QoM;'cc'c9tD!yf~"҄rqrm pq1^/*_ ms`⃾4bQ:6O:QAS3a4v7؄ rj8RB/"uycB};$ۨھa*|ۅ4q$.s/؜5v(Pa *dA`I74N-e@qR=aK"P#|v?۸s] X'=&6KsoqVGsۤRwFL #KFl(&RP%F{\ {fh B 2v0CEFKz }\رOF !~FXbl0 `jo!αDߗbA ŭL%jO,-ks@s;uRlk ٞ?\wa~/-`Ws~pQͣPK۶2R6Ԩumt'/ ZuCR)80%acS_Z FD3H H|K-~ RW"h%T?J×y0 YZw_KU]&RooLru3p۟+ 'AGg{?P;Nj[)E.ܺjBV3<N;pJ\kL ب]LPSpuIjqKȂ6YXG"{bsf$,3@ xzEŘ8d$ xēۧSù\g2^A 9Z)Sm.W'*tP`IK=9w=9>A> 3i|cPԲ n#2^9vXlI~?ͷA>pQd+6-~/ h/g(۶>5Ij,SWk3}Yoo7a>O Q];CyGֹ7ĦH!gb1Ѹs8DX3Āڋ.jjo| Fh9WǚeC1/EJЛ9:|Ⱦ8L^ a\NwqVӔiˇUGJ!$Yh&s!X+Ld8G 5P^Jϫ {\'GO1N `(l\>Ґ}h'װw8[xeNSDǍSftUq, 9ƱrCzK )0?1Ū8#:bߪc7BS,&~sKذ"[94 WIejPlD7\nz ~;Bcn_K3һ3F{Dx\CO Ӎidr"v` r9$-hw ƹ2}25^|G/9TF> eI![,Ont{xP4s>?gWV2 n$d1 3llC䗹M$C2x鴶$塣4QHrQIdmWK`0 EYhxb+G1^4[7e ,zDTBLg7\R~ p*C6G9ǯC;HS (*Ȃv 2[b$2per!#|JD }<y$wKN1J] ēDUg;}}mKXp^S-&¹3sѶiwPղ2y2[z ĝ/PgÔ пq YB(z J{l<5Y 8ΘgK/i842p f=:;8C¬ҮCU@f>l @_Fa([x$bd7̂:(+!GŔ@ ̂U:LO~79VdT.lLFH1yPǀAK{,j}@OS&NSDvFYCn39Jz@ے 4;}u8S­ 42q<CLXJZ1Â_6^l 2I coMhČzŪi+8gGPx3g))k3uChp5sQ)^#IJZԈ2v:=]ؾTƦ0,^f@":[d*|2fg<ȡiD&n>V0k0zCXC1xl{X(DD@?g6Lf!S͊Y7?\OsOFt '.H"oґPnƘl9Dh#ߤ`OԷn1g{Xɓ[^KNOIZMJY5T3-sClV ;> {w- (+ !FU.P_.cnlH)* ۵# KZ.Y)ɘL,I '<9VE݃wf[l ץ>fv |d2|/'%sъQ0TLl>B7c6:;cBa {ɝt)UDHsj|XɡM ,Gjx=m.nB*|@}BNC)pR?_/x]r?eX!TG/~g}b  1+Ԓ!*ƧeICjona Jł{tjL ߠ(B>aҬ[kR[5ϰ!R}N,Gcg$! M₻˳+:sfaL*  Лfbu?we~<~nYTKiViCص%ΰM(y>+t,mQDa+ϖfI):OY ZuGY*fP20rP%֜&)K_l];ɛŧ(}ZT_b|qR3Q&71{a&*8ȞկQ! `F~hN_Bu79h|F3U-W{`|!=F\ \n[}4U O?8^&o0=893zi[:(m {tNX7PMXalk ;PxDS֡m쐏B.P0#0A`9 % `;(p=Rh;}\г֥e yI__J^gD93ƫmm("5ZOHkMh?NݺKi0&b=խK4fP bƖ)&.[a`-]\'4~!^|ZdQs+[-uHr9'UR3/oeX*.$HJ^?pIv&kĈ$%o]>hMHCqPknIf}{)Ys(TwkȴҶIUQmb*q-c.07*n Bx= S.yB,/O{-_AtK)O85ǞsNC+xYq?fyv>TI]ecLRm鈅"r-Лx}:D$,y ܦ3ne]R[eK,򓼳;gL")wf.\r}!)1[:Ik# Tp}G#zf~p MR6/P?0Be;Rq#m.ߩ19{j,553Tnp ]8b- '6)۫+iY 0xΛ>ӵ n-FP!*@>٘_".=U Ms[Zz)az;6d!BΈ -jYAl[x^LDo[$'`ց5?J$U ,Ɔ&,_7d>bg;' hd.G bm?G#]dNuJV..YUrQoHqW-*zGzhȓː՞?@mUq!xx1Œ$懵fu*xϣyre#?‡L`kh!~rhں{[,ܜ]E\$2~d*ju[p:Ȝ:,sP9ԇJb1*bdOf$!V Gk^GrE-(\g,n6UYxJ  ;o`Ձ0>y-w-ёqH\[% AJCh h,rGNci|e#dWIEMAr>d}u5{_܊׊ǿ7xDfdɗgp޻OU&Q,BhRnyTcRUMv^-4 Ëx:YsBKRQ]Vh`rڵ6m'r_9?Bz<"e:'] u);P#6QBSmjYG,#[X_]g[! Fn|΢ZZ}zOf)4_/.&3cd*އaZԴjDB8ⓠprZS.im`aRA՛)u3ra<X4Lr ('X|<\(┍-gK3'_#(TvC=x( l>aJU4?3Ѭ{ d~B7+. [~Z֧RJ6wdƕ6ޚ2 LE ~'=Ù0! ӷ4O ` \ȩ,!߂) f=Do'L"Ȳߙb{7q`Ns"LAՁ]?F7ٜLsS#pݝm'$َ΀="k(8I$L]4$ 3Nj[3 R YY} v4 DGW _ Ŷ[?#]&șfu,YׇYEv_}1$clg|4۪t*pe[Egvypm2UZ(l4vb`k܏Cdp(gOБ¯#3{>Rrv3ܫ^[ޝ hJƞ5PuQ]D\E9՗̅~JB=)gW}a\.?@Kǭ2bk`dUHRM#Nt0G<1^ԛObh/y$Y#x$~W<3FH 2hzjLpZ(# %in^~tyKO͹fMawG/F2)]HA5l"Ei(Njzxr`pđ)Ie)l LoL JjАo"k lu s\)iE/ 2oa A@;d/nŃ#Qz)6t L6I_ĕImKj(z/K@KRÕ*ܪ8}4\hEv0qZ7z :U"6L0ݓY0?ؚ 5`'۠/Y 6 lbwx #w e+PVH?@(֦ɕcˆ^;|qMV]j~Z#wt,!__J~#أ b\胝ۇv\{ې9R%A5C !/綼'@5f(V: 'YGݼY YY.v"$6e#rYH] F:G ^z;?)fu_iCڵ*d3{Z9Hj}76 Rvcf,4=B^t*!>`L)@5{{">[=z {5aPd/rO %`YȖiR:Mį uk[E,0a4nFo 'v_?MGC$-odaZ[+x}v?忎QhU +hGd>a+c֦Id' ֐v]A Ԑ@:VC–]o{wm3s8jU|n\ 'o%)`ڠa(3 i4¹+x_$}7+2@Ыlog.+a@,հ`7^P%.a. T눼##7G]t.5qJq/8g!_)IO_?WpzD;b < 8U V\e4|O{DEOr2cwulgr@({$=T/'n;:Ǚu+}nEA3$&Q&l?y.~w@زŐi_-(X=T=Ek_++ew$2vX~DOڂ͑c[m⧅=?ėKi)tz$mN[ɼ؜tyF11Ӝ 4_p'Vr'9|b!YoSВBpc[lwToO+]]D|JrpcT"ʆE_ L&e0't|EG/O ~ָh Z7.Zt* (DzݸmvkQy2kIH> [+U^8q܍G 6YaB_m']1,oEWzNoSߛŞpF]6V@Zx'6']lZoR&S<Г3r:5L3AZCOKP!B;qUj2}k_W3h &RVUhfڳ!!ec,AhnƼhbtAx];LS3{ӓŶ3սg!|:2YVO̔*Ϊ( :KQ>eP$t؈HwVH ?]y sy'C*2sS ^,j 6o8uʵ?#ڪU˧p%/ ZuDqUZo"ETɩg"uEb, A:IHw," !m|3Un6!w7c* @y6 hFVَtGpq*T|DY @,mujZ]?{&Oqrhgb&"[௑[ C+Ii,,2Xlrn} hKBDpv$sm D\p 77 sܵm9AP0&znv Xy9!Rg MqB! nV:UG{ޜ`uÀS5 VLW^Yّ {|Nsz>:>ZDG9>/ #Ɖ"y6DfCRKŕq"U%XiD.vؔ8gWߗ}^c{t_o `bmz"^˪a5rs(>o22Q)M9dOeCK& ڌW߹Ñ7)Rz@]@I1b(nO`-!+Qwp;][V0W8%G<%w[-a>̹AnBvRnt\?[ c)G =*-P P}n뮅Fx +CG6:z~58Ep%_6u(W)l[@+?yH i+,bc& 6%"N[io_`/̺2Q2>_bp}]7Hxh`}B_s]xl;=e(~bu#G FRT-q| ~"+է 8՜n$aLNyWyӎ6&e%n1 1As3MIѬ%479H.;w_^m2DǖsV. d7e[[;O8Xlc _LdN^c۫x,_z\|PZnPbK&*h$ jLhqT+=Yo/jVokC0Xl^s_C[[0qOq>}o8 v1N+@zD?VmG|k̇"VXxڲ<lۆ]İh<ʘd@RZXlթY5zUx,vգ(~J4Q mF*ãHC_2[ _2D]QrnUS^xtIyR!ρ&>ɺz E` a.3=+XaӪ8 lm\=Z>r^RhROi% Ku ;i_[X46.Su4BNeR)IJ`Vș <z}։RS 7twK-ɶb~_(K`Hca#U+'{0Gow,#PfuZ6BP4ۦ@Cg5P,"G$Nʺ`83G@ۏ&YiS7yj'a-?-F[CdfUR-:g2-mZ-s&~γ 3`΁: fjv,r ,;,_`1s"Lx>%wu':v>:*\&L.w>Xi>59Vo6 q3Gdu m5ƍVsy2VoPxtEjcb bhiDC\5K`V\]Bm@]Yo8 5@/LY8¯#S bAUq'/S.uWTkl |R|PF*r 븭LwXL4t_aDy{y nuB)ǂ`f:u: :pvQ ʜ{ǟ~;wDW;'ͨҘ'[_ QC7"S7'_Sw=O:omkWjG+A'2/$REj;׾SU♿A=~*AIP*0Zu+4 MgI:^4>2)%ATDp.qE"hKSmE^ve{< JvͻO0R^c-͝.f;pB7$h@;^; {3pqAX i+-߼CE*"D3jpwKVQ&j6vڋ7I:xfr!;b2pAzR:ԨQΦPRFKVQw-\ϳ!*JH~i)^Vd5W\Mp2 3'^s v agf=3o0NC!1 a na]uvJd3nd撢;wiܩfǢ,Zw0ܡ/PWQ*ef/WBp,x[ϗ}Wɗ]#|<ȍR:sq[{,>W A^[@J@d.jB2mF %WBTx[d R=jXgޤȼn1<4Ǣ<5sBpZù4 V;xG }/tT^"aKJE{A uRD8믮__ͽ{;%!a.4x?[0ۧ(pG8z 9 pq|=0@^GpHR$ GʛvAʾ&2{sٜ!䆍flV|ƾVV5U_`M8ۛM)jI-±K7`]!,.GlU?g_(ŞdӣvLE15),7>QG7B8]u3:mDf7ksȧmBiVHkCsJ|^_8 ?#[TY&5Zym 4q%Yi%P`j Ɵnv>;. ifk*mhI[LRsPo*$pl߬{oT> ܊ ($}&2~)AH3Y^hM.kf &y JNKe)Ψ阂͐8ynf馚\//00ű3:)as*%c}Do1#ItDga`#TM[%@c^Թߪ墝1'I\Dt*t-yCyg[Ŗ O dw -͒iH {,Dσpc(xO F'A]%5mcY}|m)/|#vvwcCwƳµQkOpaK f~SqA8 <]:KkT/}zE)t3[hGQk t\V9!SFi*?:;W9"B dFZchKl%-dt,FY1PKx'?)5PK-LSd>92Ǥzy4}M&TH7j3""} ,4}tR+Gp}rHp^a̧,J#5_(a4lzuiu  f}+D͉ԡjw$&DǍ=/Ћ gKd9'ԼA.EzsR'؎[?'|z]s_,~\4VR%>76Z DL?|wrĥJs, *vK=1:s"X֗ψ^tI]y:'܌Pv)f)mC +{< *#a0_00w/ p7:0w0 =!Q՗h~c)3\Gj,ǡ %D#*q($"--?I{<At2UE9,Ilq1Osl&4HtTx@ɓ" "72[—:4O'@4#@P[w[b|<ءQ~yr (l83JjyXaBQ%~7׉I%+Ba[Ww 1&`Kԗ4Oѣ(9- 4&q9'؎x[bb %{J^ƪ2V TN܊hRneFcl./c^psFbora cKV}T/Kn"U}~\tΦǞ 1]gAd.&+-}W@VڢZl͈',夊C0hmҒsh%E3{+ѿ%"zo!uꕋt#76P WΜ%tHoH5j0-VMÙ&^R>H~D>^F6*9 MVw=ӎ݀Go@u3߁.Kd3 JwL<4!(ajPQ̣V: W1ydM`sBnir'&}7SXctW% =s=V07-h_;|\Qmd}҂y=3~NG8cWs^;r6YkA~ >59 /2P_۸`t$I:Yeay^?Ke+O.߶X -B'P}I ycUY!TP90vٲ% }֤0Qgq/B*!5E_{JqHDZSY눉q9d;o9ALkXTXH`oq5 ěKf Mh$`eKEؚ{= e94RO\_.Ⱦû VZC/ +.3bfoVv907h:%.C>"k'n@"Rt6e%d#9Kl6GztRw7oٵK, ;x>cp-wTj؋L5Pd5n :+-_רkKl&԰?[9?ݿ[Qм/^mL+Uf/ )]܄(XLPg\vnR_er;(&f͓Pw'p~(!yCl=Q K}u2hÍP1!(irA1U^KEX3C2dS%FUiǥ|-& svQ"!#)DA ;&]!I3 ;'Lo^ܵe.ݵI+ygM <:}Jb-R &Xy$Cג9mڷҢ Q,[+X9)own; <}r.yqAIj-9,}V.#^~H\.JҹRsd/mA$aBo <0Wiv ۸'&ˮF4f W]jj& _'Q60+Jŏ2)k`$ݢ{2t<)QXD!-#jB4m @u+ WaZJxXs q!1 ZP9 pnh@ŷBA j&׮.ubJ2pf-d;pNKˌ|O8sC^mTͫR|e!nwݜor6'z;CMI[=+q=/Ƚ^v 5)t`VcG^FL^%J Mq d`RG:>!mBv8ػwo{T)"ڿd=g!B&e}w:.~Sؘaw@C`DXA;r_nsK%d]cgy2lN#C*eg5Zs@SH[_)ayHu`Nif绾"Ĉylb"hC7Pqv RG"􂡁Ÿ$:dqI \{F,¯9*SrZem IdDC1&D9ώ5޾!XҬi#zǴk#P°g #5q`bdg:[#{T1*:V~T+I=an֭$}&$O:scrTl7cx֫  XpNK[ '49@U肗޺X( b>PӼt-RÈr6?DÌFMs IƠPkW#¤+(y@nTE/A|I vMhwj~i*&l5lRcN叀Ј;|NG?2#}eTȀ~&7Ե-jOkX<RNt!NTE-=4Z*FЁ:ʃt 1hIFv X>W C|jyd>! ȏq?Y euOqWнom4yh~ ,+C@b :]{ޭ5}$P1㣨`'i,s)ˎGծV5p%5&?X sH:eKXy˴lB^G%aqqb4ztdǻeؘV}ي^!|Jc:n ܩ;43~M=<^IAAM{tYcƼ*dLs㲁K;TPV˨&G#I`h4DK<4bw,_$BLGn4@gaI.uKJnB'221Zԗк8z06W%,ӨNGB|oyG} fex<6FIא<5͋r #I^;_žn*%Z;{7~B4"PcL/k5 G :]۵GOС̭^<~6@8cj0PʳcG4烴Zo5PqId62#R)qs f4 CxXJ15DMKG Fg 1n@yZH,n=U{ϥumrp+({6P7"TjtpMّ]/fCJԳ>m"^M4UaOi1 4cU "oj$֔NlW9v5YBwr\ޅ Up g*.n`Fd}s}W{+ m Z /y&~!cR lyV*ưKޫMUv+׆bj2 8dc#kZ};4SUN~lw$ n..i@3Er7Hsl94Y'LHZ4ecm@UJ|ed%+) U]7I(WaUuY^$X(kewF͟-LF Bg=HQ% 8^߫hQպ>8bm2cСyܮߪ2u+Vォ3pA-TveL*Iaslx'گr~l%O6/.*vvXgcrěK2IpܴE_ \u{%4@/X+Ǐ<=i, B>Dv4Ub汦XO&1, 755yjRZ (쬦.%CMKgCvza?zsku圤6g£cھςɆgkdyg?;kSq+*M3ޛm sKthndVA:ğr6+vTq[2AV 컿4*7Cl7uFY>ng.D:f-iǜۗ<%oL*H6.=dgڴ\ 8٭K׷8ߒAw@/׆yͫs_2śD]:c0gwwn~|,Yٔ+hŸ!ƜrDȈT+2莣#VognuG1$?-w"pv8iW ؾdD$ GtbW'{Y>h+~IŒŷ- wJĢ~托۾Ÿ8gnT E_DH(n$ R/^/ w~Wo&ZۯW x`Gm`9T)(YL%e DHeƎg;[6 s5I3ZLmbyMUXF vpUi,"&Gx29vA 7RI05xYΉq<h]hcL@zyc$_7![<(`fY/DO=H̫5+% TLY27^(%$MyG}* ēEa^eF,p089)Mw@EE]s+>(/̘ Z鈣@|H=+@}Vw}5PnRCZTS58wv/M6cpX΁QA!dԶXU9dC6 }m!o7Aj3QQDJIr0ڴ2':ed/'nRTg1~Br+f_JjW C50O)R8$X<9W8w; ]:dmscIk\9:W tz%zP;gͶH7sݎK̘pZ+7sA x <\Cr%^KP?Snc+M `5Y79B4k;xܮJS@)ٲ~`Ч~1/vvLf\2Hm) uTp@˿je=poX 汨 q>%^+˟F  ?(jZyU6ݵ>AQPo )= rP["VK%@zE .8wOVel8:N V{\fzHT/Vx3.tPYdF!$\aq0Dɉ/J'Xq7r`D ѶY<\V#K҈K:`j^up=\"vUzK&N+T41a[h K\~[] qOߧw.bIiJgA<l %<xvIJ ){Zł[;hfdrsJuQF4Б\zmZ63S(唬XD`nT&*Bf5*l5+ڙy2PĪ/+yT󰝯ٿRS/~z8/n;q)Kh(6ꨣ!)H4/ 8)HNyVoraꌈ󰺋+DR&8Td%'aA^ >.1[2؊%[OK]A7CON3Uo05;=VQ?A𐆟/S#ʻ2+6m쑕B/ ziRJO.?ު I$A|&J<_Е c "b7QyBIݏ*uz;".{xM*m9oO vh_V4 JaD,C2"#LqLcy#HyFV9~" v7 4R\Wc ~CMc,LͅK%;Kd+E?f⒑SuK=(]OE&Re>>Q'RCF3<{Czd @>)O5Hdv N-,<Ɖ f"WL pY;+R/fQKIѢzV 0Х=)Z+y'K(O^2؁[qIšvXLmOL7 0?ݸvLξ4k k ٰ$ƭij~ 4X|8&P嘰1(R*縔0rPƝeeuVTp:gNǭE\z|괰[j@~"eZiwQ$ p ^m kl>[dlruby1e0HDۢ$3 wCNap룐8=Q{P "ulFZCx+ 7uxaZ)an=> EXK:_]l A RLyMx]6$#̔},2υ`N7#"5Rk?؇x?_ 7saE]:;G3~e5p6θ.'¡njH}[*yut AdSB sW1 QMN׮:H~ Ռ..-Q MG5W~!6GK S]b2h8O!SUwMOQY^zv $ Eѐ# [FV GFs2Q¦F}DFЊڸmJC:P!qX7/ʋWRo?y$M! wG[wFa,MVWO3&d6~Cg<kug-,Ep3Y-iWlzXcCYIpͨB#Ю$4r7{b=yM=z^Ll iGmS؟H9SccJ?:u`r::_UNr@T:cA˂\iCC$@afR'@xcM <0ڞ~n'W֟ 9ك䖭~*]q|XF氪dSHbPIh:{מ|7D@lQ#\k*:ۇIm׆ٻƠXx2q1뇗VMݑxMYKϲ`K!y.^u!)sUe;K\Ə7t1?>  %QIJ.G$kUq >1MwsPOII7v ņ?Vơ! s2d}nL{iyM:-X)Hƥp!i59>T8;mF_ eZ3$݇mGVccgUo%{(F1fw_:S,a˨6}f*A[0 1zTͶk=RNX/ 감䊑 \[NY} Z-"=_ B_"\ A]#–Ha-" tإR"MÇ CW͛SKr|@ADړu6`{qIUlAZr\ܩN$:h15GO9$We9bu%( R*1eV#5}/<|&'"[DYĩip~0hɲvpF|q(ᘔhxjc޹E4F1DӾU%"$oߊI71oVyRE!?_ԟʁA*5=gn I(?yoCgpڴ4RE{{1{v v z-I);T&hoj 8 C7uF9Y99SpM^D\ǭU5:Hߏ@"Jgg'"AA;847|V0Uͬ'#u?\rodnʶa`0iBű/"Ii}ON_XoE8eQ;Evwmh48?e&_s]vNwހZиeWk]lcmLh|%d0$L5k1M(v^!c0[69}g_^MQY$e<DJG`덌$,:]HِVyn-wL7wXtmJAYOn',r pt85 .>CvX xTؕ#k?{De2`ʐ~uwnzP{/Hn@G4Ub ;T4- ] !,L[ĀqG|a-[+Ϗǁ <[`OC%ffi5 TW15P_ڳ~c'8=_fEC({P j_p G} +[le*JuejW\vIaZ_g\4nrT ԟ .+m3nG@5Y".T":${#jq8/{CG ;7=CI#o_o74w80}uoR.K. C{cqN~5 v>}A]Ktn_6#~Vhk8,[l9@$WLL\%wK\UO-5fPU\Ȩ|zVyEe;v)dHN$=<-jl5(3 n/;?`z'6N"z7>LONr4V/(QM(<ʱFk O~4j%jz& &s^%<Q9{,u1ZZͼ Ѹ;@*{55pJ%VK#W DɕB}+g8im/G 'é[%{[\[b& 0&mHDkgqZ ju)|~*ǝ$X 8}lv!aZgQ,gO85WpǗfF 1+X 8ȿ^5jz1vxVnTyLAR*`nGp nm1>םAe\\PdDE]*f6 cѓ_])S6oF4egW?nr.bPc PCg]hznb\6uaҬ3Bhs=ۋl7bfZA+,ZB"qUPue!^H Б`X*c@x/,-fu;hK\r4|e;8]!(qt/B_5Y_j=+ t$['ۼu3Ajv6;U!-Q(&ŧ†hSފyB"{ì|{)Ab 9*njK6diIݺOCHY@VV۹Z{{;f|zDuӵ{ӓOmqB1bŸʰB#'A+`5;.NTЌz3앇H3\tsȱ>vmyn(]mQ{}bGXH7(=dUBMi37zSڹ5mfԂ@Ɠ]O; {g荆ɟ6 ERNૡTDB"vpo>#PkG 1dnɳ}7AY=B:=(T*]S4}H, cF ۂ}R*BdŠlR a) 9"R٬\gjA:\S Ro^yL*FPT=g=ݒBqs w#PHORS3Q#S뾯xqɳuOBI?> dArRɍ00D!`;:?1լ_cߙW㘑)2Ǭc2cƐ@\v*intUJ0Q.[ 0$D鍝ҮəȌ8j {D2[:[\n3jC2!4x k x~(KьuyS(2(u:=b.~d$8:jYi~ETЃRs 5Sʨy= ^fFbRm ߗNI"txgG vQ/Qhz^*3]3EzlR!tU1t.\PoHePl1W1?S" @iE 'fgwEĴ!6>O"-sqR>H/_f'#|[rQkVWkPkKG&c>HtPO'JR XՇq.G{0,-]L/)JȻ=n[43{(H9D R"HX@9ڂp7-L\} g p\}4M46^JaCU$~̹%Nf!1 CB`R(GWSq#LK.G`I+LuDxp\*$ _jBeM8rp'*DEf5.c ɠs5nuѽ[+$reCr(vcck!IMx.BOuхm Iwm/]HgQFT;/|8AR:BI)sK);_mL:RO])\J3{o_o $%a4Y#˚Flwc+1*A>bcsT)-gv9%M 4&F1 ʉ Ƣ~Ժi;NZfnamŗ Z/L> ƽNG4@ t˒ݭz/8G?f¿i1FeɼCu0I/ T[(횾ׂn!tW\(hYd~/tzdtw[+gP_>4U=*b ;P¢x:PFAsY-1<>gF&2!ͬCۢt%%0=ٛ1[\l%KOo;&mRM.3"-T pc-O][_#!u_oE~s}L<ƻ'% k#>-v2݀{kxdE%SY<*],-QYl廧Ժ I wH>!ϖʼnFI(G9'N9ڛ06L @v^| ӊDW]~¡FσGEM'2;IJZ7l!bqV ޫm}E'$ן[b '+=6cemS,5r|uqApp!4j<׌$ZhDi5"aK]tыB4/VQxhg=?׿32 jNz*?MZ@vF zn;71%y`c{Bf~l999Ar(g5,D5)ЋnNJ9y?|ڬ۫z/ֺ(Ͼ%GbgDfWz)ڙi98=nY69e&|Q߱(2#dG éJWJzPi̐zyr׮U}45ۨ(8;2nɱн&:(`U<$VHI="Mh6WČ[?rC˺'4'.[ xgHʳyS#ɏ45 Nn>)\y=]x$ɮYiboIRc03;B{KRo{|.!\CɛTg5* 7qhrd;ӌ_ &F~K'5\su}ClۑK=`z%8/H[\ehk2i(7>^@GY.Vr+behh6 "AȰ *'oYyAd)m mUkm) l$T8wpW7$z/+TuW_ɲ ge^9*g~c\A56pwvS(==D+@Rpp'B_,ec~rx(|3v~ v j94y!~c2󸡀U*KĚ$w1TK:͔q lq1mZ^e{t>9t0cfzç] lڦXW,pYTRv?Xg|E0V[;w<މiͶOIaH.9psFf Տq@V.rb`0{"KESTVMt{>.H9\@b>^ԑy<㴼8ZΘ?xf+jGՍ:Ot͕nۯn"lXj 5aU/Gp(b`c Hm}BZQRt-FW@M,Tm.#B{M"4%᙭lcmH %5w{9K<3TC^OZ%۪ E{.O]g~P~y' ґk0Ihl#ISYģ69Q!^2]CҸ<9>fr\"%2jQIg؃ϞΩۡi0DAD<_ lޑd &bJ}C g#cgEΝ1a)G:o!Ǥ" "(o۽p-jxeK= G~c%*4 ' R˙s'1E 8t<&N)]zi-zJP*d}kŧ$ ou C盰0,7#'S[ X؝h F)Xbi& b|(i~l='Y SyU"&*SХ d9.}o7%d^{i~1>cDBhyk}ÛAXMDi.1Ro`\܍:7nkRC;tٙ`zcԗNp%"1/әA 8n[2RhE՝}͎޵12`ڴuUϼCޕb.oq% !Fd ЌWm}yiUȷ ?* Gc,m4cX<- \!|b[? fM⁃BT"Jދ|SYk 0/"JVwShFxwȂ<42h)'Ff#~H[Bz&o29f#tZB'>;a_.hz'ᄫW]`=UISSd~}P3SɕP@A!zJ# pG6zbφ? ">?ң w!K6VHpbCk6nrߜ\^v