wpa_supplicant-gui-2.10-150500.3.3.1<>,eܲp9|8~wz&^*F?A]k/y[Yf_=_|а;_R? NC.YXz7J\\:"*FMU%6^҄ܘi?[*E kkM#;{Lf$!8sH{:o+dއpP))|(m/(Pz7}}=Vtoe3 CB¤.B>?d ' J , BNkqx     &0\d(8*9d*: *FGHIXY\,]4^Ibicdefluvwxyz8HLRCwpa_supplicant-gui2.10150500.3.3.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.eܲs390zl31 |SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxs390x x큤eܲeܲ411aaed1de829cc25cd67ccee5c66ff086c1511715d5db364f60637d1d1ec542d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150500.3.3.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(s390-64)@@@@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libpthread.so.0()(64bit)libpthread.so.0(GLIBC_2.2)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3e}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)s390zl31 17089625352.10-150500.3.3.12.10-150500.3.3.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:32791/SUSE_SLE-15-SP5_Update/92c4c1ac4c1b5c1bddbd97dfd31e26c2-wpa_supplicant.SUSE_SLE-15-SP5_Updatedrpmxz5s390x-suse-linuxELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=ebdbb61c3157dd2a2ac7399e57a3f78f7bcf46dc, for GNU/Linux 3.2.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)R RRRRRRRRR R RRRRR RR Ra 0<8r%$TM:utf-8c710ecd22d7083385758918ee482c19040255930ca401938dd058639eba2bf31? 7zXZ !t/s]"k%{m{#rD~d tGJf͚tvC n9Ad[?T` :SKK9 'm\w`2s5 EU?0yݣ;-2`%nm:/͑qC| ql=LWaTe8-,E_OOeDxypԼd睊mQQ=3ݔq=[|Y3dbfxd I<6r,A`P 5  *fmm[d  {+]C]sky~}Zme@^E,'jlـJ<$Sd˲'*W8WtM捻Tl?Vw0-Rё#%ժDhlG m˼rģv ق6^ o`$xhS GեNCm 5֌p;͊V_޻7ͱKW_5Nv;)["|$/iNcb^6E7[lnP# bjĹwj TS+o \ȦZ-R h/PqΰRl,k}GPF0iNs=>"e"O%v@㷫 >gl};` -C>h 5KO|; [p8N23̬ D׉9lY' $xXp5+|WAچFu`GF4#7'8d uKՏ\FeC~-i/]k j ٭VvZܶr1~Qe<>n]͝Rf$7_)+]溚®؏If}|khXV5uZGpBGI0FTmG7* uB ^B+,=d^:a}VZ=@GzmP&` L0!IRsB)Kp#ER3WgZl8|l'd&.t{ˎ{zV$hKacug '?Y97 լ ƠYh=ᒣ- QDh\eHI?Kv{0 n|9On񅌍9BoP.@dO z ôTGA'9Ij:Xbq^7GTׯE]߄19ײQc $jI(l XI50xX'/|_ ˿z5CвoZulkwn&R9D4WF[tg*W;1{#IaQ̞h8S`1Pjx/rGlm;Hb݇ߺ l:Ϙ7`(T.@E4sjPsj  8FUEA7G 0pb4]@@L)lѹi"p%=W}*:@ӾN&F _wbk'FPp\ y?Yʙcќv7b KK۫HNeqHbފkl2 ׈ФdI|2#!*JnL9BF6wWq~r)6(p^ ڄa0nd Ϯ>슁Dgk|$s7T9;>!0R^Ah>Dh @ g}9D5ZʙGab38_͵<dJ;pߊ^PT'fk@dҍj$EẂ,⫕P굙׭B2t=wq %JG=^Szb+.C"YX=8& *"kZo ^agU8i² pg yt,adڡXX!S Cdƛ7i6b) :Ic} n)Zqhtҹ(y+@C\8 u϶ @n1NVYL4>K|X3-Γ`!kU'$r'h1kt$>H+rIp_iÍr29eDF&/RJ n\Uh,?4tbCmvϋqՠQۥI_e[>U%0ݭCG?AQsYQlWX0?g݅mH1NM +•_ RȀ$K\c^IPђ&Fvـ=L$wt^K(e6QaAf# zM4nvk&Oge=ݛyVܝ@]{ֶl`'hDXșp>H kB<ӂX=1",@)=MrXKܖvX ٥2S*1ڐ#v%\ T^ݖzѢ|L(j U8V^&Ȼ 4Cm˱:qyK|`0p?p|YBE9žB~tՈ{KlT Vi€zk 8d<#p 0O|]`)vwG{{_fAx#(Êmxj0.l)y{e>@Ht lg"!C$,hE_A:;υeӽHa}vSV(`77bO¡_3IO5i" \wZ0Ė gܥl#E3 (0 ;(&jLF" p ;-=65NRW ' #̶=BܞXT拔?=7TKFdp3<5\_gP>'\L?ܗ|L)Il" X{da q>+h]˂;%V.ǟ!HZM۹B]}/@B͉ʈIX=f wFnTY$m,29 %;7$[).lQIEɛLMdYuj2=?mϿdpf8ph Ԁ1|5v<|bIE~N:z^L$]ӼCL_S' lZ"8' p( rϢcMغqXPfzxB }bOR}Om[\vN\k$yF]n&X 67&>B ϗ*3%EKKw(o{rֲ<,ГqZӻeHP3R66}0\O5nm!Zմ0=IM-77TxACܚ_sukK㲵8ʽ_Yf5 gwo\LDT{쫢y / cĸ/:{lWL 4'<8K|S {QЁf'wiҝJ8xaTVl<` pzi5dŐ|Dc$'kncU\|l=i0m] "M:8'{B _z`dBZ %$~=.,GW)I38:5[E_gஎRjp, CIA6 vO1Fe51l@+`Wt?šeDרS^O64.8:i، :mף7?$:?ͥ_(p9=yK=ȱe`q7O*5 &ԡHU^=$6Ŀ|x>͸a:Dl#+HqrHѕbꝉ ~KoF[ EeJ:R͡ _.)ux=O} !ȄD{Yb ݅9S葴)gcLb,D"Kۉzb%po=^[-uzAn`!fk?tnmגԟB`VW?Kw'!wE듢4(' '`M v|6`p>UAf{pߵ})L(&h5Vn>b|v/Mn\v [P.N1EA.hsD,c\¸  Bf[DZ5N鈷>u'L#$=K'H=9,x-O+GtI($ 9/0HMu466_3Ci:Kt~ zR? _m->:h3(%Ʀ'/?Jܬ"^6ʢktfrk <$q|&vȟ`€PZa ;dh8-̊ΕUܶuc:2Kw-ٌA^vv?QƆ6E}rrvN/ `+H$%__"w݊(6gyvHbjІ3 &Y:T3:.7 OEWu,~qFA&4f,Đ hDoB1I7IHYj4sQBW`mAc/0ÑsE{q`5m)aWQ0M/͵Cf D{~"7V$\{bQع:S<ƴta-qCkuv߻JRߺqn"2Uxea-kV11O~̖WX0-&jAψ(d! (Rh B\CnM)]'JQ;*2036'g! &%2"*uN"`{ϹPSr7cB0t)568bHGYf{A+?}/ۊ}^5 sW`r(UWm0TLX4$kW\wt,ǟkwY *e 7Yܲ<'w_> $_b` gpc7՚F"?7`/v4 7&.E" SR+zZx ɿ A㊽rւjn|za_.WL&j`ck:A=3Hw@(?(_I)pO@%vjt ["i8IX0eلYmE V@z"ّtmUh\KetnlVq8z#FE?Vx׾  ceŲfǞ}E}[+59TBJd&CjD;~vuM{~tL0ؐʦ”^|\݃lP L5" ϛ'%WA k1a;hsNƁKA 7joФ8DZ` ٗ.'@!3{Q?r7DM->Rk=4֢)]P7y#"['߶ `o%R.D$XF0r4kZzleq;{0JWJ|1oÚm ܣh% fbtF<~ ^|vWm>*DYB..._YӬl39A\r"R^PPb|+Xcx.Ui(yg ufFޅ&L(ޥ?猕yIYuKt37>Swf !4ͻHM9 JJVEo8nmPҌ>.fy#U\6CDFPSx~WnEEIJ䵪4PW4=dIe4UY;DAe E/#VgL^-mj "XbȽ 1K݃ޫ[Jw+OSWHS7HF*sr}kk7er Re'䅷01'LjΌ,* ᪣ۓr ^nk [˔ٯ2' ~qxjQD3N-^L>l׸VhPQ7 6#ķQ)xg_g5u0ud@Wo>ޖ[Dby9~.|]&eߺYәd|K"n#?)47j .N@A OjTZ:(&fNl텆m%~S?׆5z,5 >hIǠVx*BES&Z1sMp;*0pVT;XSxEþ! K|*7Ƒ[*Y`}zULQoύ_nKI@G?Ѵ)$I; *m:%qO%"J 0,ɌnI tk0'NDWzOm[F@#P-&!`HQEՄf5~N /<<Ѭ3YqU\ EjKD)lO*4N͂4Q͵fwKk-{,@3;fX1XG,o e-yNkmLSH6Fl&L(^rJAN}=|Rd 5v pE{il :nmY o2czYW굞wm #mzYTQ?̈́Y|ja4$|WȺb p<ӋQl<=oԀ ֑,*tRy>Rw\*~S ~CHIȲjÝb@i `ȟ[Fz1׍m*ؔpӄcGTw?;źeBݎytNK7sͅm"-xo&e M^"FvkbStw*)­R|( :vG&@EZ҇bqg إί ċmW}M3.`&]m~uzɻ( %%X>M:Jq Jj&_NUjmmat0%S qm)ާNmqy Ϭ*&k ` vzGo76?1G\@WЪ䢑A)8FAVNC֝9h@1&} CZ;lv&dyvPBZu"qkRn ͚X|S Q$,E>l(}a {kF#Cn!0+U J^{ 7'}6w<@TKL[ht9;аgmyLǾY5I!w 4Re7?4/"i#i۹b4S ˳)sfZ0}Uw8w>^& (}f?i`di<ә7K6q{w>P|rt܂ #Hum&e19Lx鷥1H#m: 4c'ۗ_((5} KqqNpjWq2c lK~ 5MD$ :&w1QFT"Ud|1.lgh?Eű mRw켲pi2P*mh*ǟ9Q"Ż,HCUPL(Y!d?7܌mB 2zwHy5 l["N͙G2e^LʭF7Gb%8 "hS.p6L(xPM3CBW ɡ4ڿs>F&Ow,]5[.]P-Mj/LrkeO$LLj+Xt.^uZ*aL\!rZQxp,Ae@|i`gyȒt k|2hgܭ/ -Xr]*C=d<>hhz2B%K۞>1s@(=yI:v4ԋTN!QZΕ?ls v@SzrbZgj5 Ju3J Rbu?u1ؚ8O%jz`Iwv?41}ж ACϰ>0J65 =,H |,<g?IHo*k#jF$kSKn"8꩗0nȔYs}EKv a"aEUQD!J9<& ״$v,[B#A0F $zTBs{̃1u̾P.]YJԅۖs.ߠLcBb9p3Y{;;ufa JC8W vv='05H9%~1 oB{;@ S2LAg_^wFf`u|j#b%0B]m~ iQ83گ{p ᄉc ^Бzw<8x*t^O˦]fwd+)l fi o{FAa и8."L:/? nRc,ix* tA}E6s@-Q:65]sp W0  *)VӔI*X. bTjio-3LXٟ5 Qwq7 ` 1Er'q։ yk'(Vf&A\'Y!hɬ91}@[T ||oR3UevJ3tEջ,n}+pvN,yS~\ 3 o ̈l@i:>V[G Eo!(_ 5{hGޏӕJ;~\d֘jd$nXN.m͆0k)]t}a=%țxXY\f2:uKPI NW -{ltH nhBƲ! YpHX neſ>%Q*+[ś,.3ɦ fls˿eo":33>?a7MDU)E_!`/97)1" V_j/ L:ǫw֋TQg=B0%o=$k?fFK*e핱J+a=V6\cXkw2]2D$j:}/e⬤Ԇarሳehjo1#U"+f.J6PcF}V/2Lw)iBPHoѕ1iWFt\a"tJV:B4daӖZw(*u]ku{qHN2Xe՝Ա2ᴷ-iQaa- V*m6 u,xf3ĉw xU$rU4@dOtϴa熲:R?@ 6򟗗oA9X'GAFcϏ h˱.6.G=\Dse㝠7YYq+i X!-Uj4.V}xdE]FXZp1\5$3l*qB OTé_͋G7dvzg8.zP >tO~!:7v7`5SH B0Z zo䁭loI- PW 8fqky {6"BI/Ҩ_dȑiϞyDak"6Il·4y/|?h :8ʾX*F`dbEr[tV`^_lZ`{|FS<=c:l ģkHPeď/(*~i@ zɵ6s 'Oy`3-0.s<#V Y*H):OQj ?g(\W؅R2:"JWHiLFhmm\}XsElLA+ŝJځa:4z GOӛ{/H> M\v-0{=[㡜w?9ie*Ri5y!(ƹeN_05NAX%C<H_(Kr7㸺 @k,lh:k8mJ~$Y WpxƇr`|6Vn =LP#$"%I9O0SNnQAUE#+N _%,}zSl>*GK ;1jl|5"Sx(Eu=2kQdI`aLҎkI`رx;o l] ,vm{?!b/ aU%R$~,bLy :CCF^E'7&GA&J 1Lwma:"kJ+#*m@@~yQ/W3RnqWRhDLWyܦJ=ܮg+Ш}Z K[I+;ʇ[ha'̺kYVWdS_Np@o [a"|4e`24`S}N=H>t؏xx^(;S3`iF-R`}V1z^,zW7L1~h.0g38NM}Q2jA_R}?e,$aC,;ms10ng#e9_Ӷl!DZU#՘1N^挪W(B~){N(GU˔BWMkz-=$Xjpum,ȇ;}~pM]{jlwN9XYJkhNS*W0) 5ש%s_O݆t/v:$?.,߭چG"W4Cq jC&aߗFfbt$AJ}tOs9ܧ F0gS<b}0сlqYeb_Nn6f3)g׃)V ۼd-p~r7?N֬~0<]˲2_F~ G`#"u5i5?del<#Vn~nl+rj/loLuY gtAib/4VAws *'YL*& ke  2YHko7dJ́#s*#i^.vNܧ#d]a:f]S&$N_$VzdTTUnPQVff96YeuyTpWiPVonfhצ;h]^`&1UZi 8I&j)s3s tdf:dzm2dνx{z&:}s7کicF W7 {yDMZM^opb1 G{T+AXb Vg i=/ު.Egjk32ﹰBhDhI:<'-FXu*4)+D\Qt6 }GozJD&c"ȧuUT)#}+AZrqwT VoNz:ц L6U?ݒ4ͳ[N[=<a1LiךXAMXܔ+jwyv+ui687,AL(Hljsau<.WaӴZkqm!߭w6;]B)Pg*jxZd2xs{ҏfH` x|!GIHbU &[5Hs?J8[7ҬfgwZKH4 BqkT/afxE4: 7cVOHYbK/Vk?VhAU" o'JOO[ e`뺕⏟LT—.6.W 6sԧs@ 6A Zv(B[:޷/? |zP5nIc\NSoϓ s9Hl!ۈۃY&iy`LfV+{8/ nl4k|TYj S ?]|u!/Do`x,ORdLo3ruXJ0?us+q ٩CH2nrGu=m왼Mqd :c'&xlDbmMi'Q ]d:OT.z޼x 0U~CA9pqUhPɬF6 2Iuа *eĤ-f,.- "8(||^`' u#?6 ꚴ:1t{6GᒐBJ $pD$EEr,YMbUs0+-۬ϐ4@ ct?(8R\Ifi #c_ޤǰPe*5+HU<]WpO2ITJVe< $xs@ Ux]$'&|T6].]va[[yH0W~CjvZbElGh5`w8c~=ock^ϧ+gq-rD} 0`+:2 :lt1$ajaፏ6Oe\6¶/htE~G&aYG?=aİ.ǫ~QG7KM9̷P :G:E$75,*xHyyӢE2Z2Vv?Pj2h0Iq˰x{AFTa~ ft!F6EI{8 L@-pβgw'kg/~{L$=.Om>[)gv̹93tw^|x(QO&" $b.tZ$ۻfLTr:I}aVƗ6 uSZ' =`rd,%a]vaԳOᨁFߴ}P%v*O|"`†̖7}bZm̼$@˜KL:VRz)cұ`<@JNU[$z5I& jf ^]k5w_hHgqb`YmVVE(H$!Ii|Cs;ĺOɫl)B l N$61<.<^3@`˂whg,;"gE$>'!'39#Bf_QE`.i s$|J}֣(գkGQ"Zb[kz1ux(ZiOᆲ3Lyo99: (msi 'CU I}œP=H`icX3J0dXs<@:Moqɯr{D1Ʈ{S c4tY#}emjbTpdj0q(awկ-In@${@&m溴^)׉1MqVwPH5+:u\ˍ,C,B4( DraPZd&uvz\$EcLHC#KΌC)  {G|[!!?T>E:\!#:4aAuHD#TE4ibi3/:RaGԭs滜v!n^}f{acq(; Z z[3yK?5$8N<'~u9+a B!Qͻ4afV? ]ON5(mcJyLrN9(ڥudB15T?*>;}|f &?0W?XI^9$E ݴtm`&I 4'%t|1.u˞Vc Q>EDB?YRUH9hFfq1 VEgiU@=+"@LGPR1.] ֑)[fhƥp RFbh,G$RtMzȫm85h7ޓ}_@v.liaC׍.H%UG__l ӒR$n&w`ayeoXe ;iu>A͹[u~w:Jă$_B{o"dZ !6P\/m 9hs"#*ls4x-f!b.3{JeDm# nd: 'An;POP~,rd̏ޣN2`͢gn>h Z *AqQU<rhqiSQ߶RG3wQ]Mv.w[NK`qPf;̣D,n=۰Zvlp9 s->+!qDcTicjVNؑDgndt}Zk]ƠLGQQ5 0hL]/n?tx̜ɶXŘ_:lr&7&M+@]6AGnl %Ɗb@^B ;{戔SPO8bQoOjwj#)ܔbbsqdLmެBlla:Czw'ot0_*Ix{D!6tx'RPӚ_Yy jȳ,?chxIuX_ vC%q&r~&C4='kH$1e?6?(*(@N>: g%dH\W΁-\)`0&4C' Lؤao$R*6e`+J"{4v';t3Q߸@!?|*Q]EOxW_VepeRBb0`k\ڮEnq.LͰ{"9p/ $#rךRGGGbG3:(0/H#aI l] E >yU#)oaË8~lw=V?3¥eYΚw,w\43GMpÁԇ:3&6M ڤ1*+k5 fS۟x#}} 8QGp $cm .9z9RJLSK}k8Kvפm 3Wǐ7ȦJ$=glܝ8M Єbvnv(h :lqGޞyGz!n灝'"&᪶ 1 IxVEjjKǢ:D†$_ğzhVI/[6vXK 3G(Ll 0Qg47qZ4P0u7kXBvP! i-7.B'9.`6ciQJX]v*zr+>w-ȧ$ӕ)?F?MAca?4F_i_9IT|]h1 vҔZ ˹|?0\7E E_^ ]!uf[nw lmSmdSvtΝܯl2Cf-Vnڅ)Qxqg. 'h8JmWe@ Ӧ\(yS\pBn̵_(?%Xy |FJ3Gȍ+?KeEN%,3AmVoc mJx{F c:f{>X9t\~>L}\e^O,״z9R Өm텥u僑Sm0~Ĭ;3]qGS,yB+' 414E$7?Һm5R ^˴d;M&, zu TNrN\~Q0]|-]6.֯)ԍcBA>5N[ke[ZrD U^76j ;-\@8_Mյ_8MLdod\j B4h'N<ր1fBGI`1zu۴hZgF. Nf2Zp NA Z'YqGjB_3B":kMD+q"JZ.am4QF<űcZ5.^%K2(u#2l%16.jߩ)FЯ~LQoٻsC +#$*g:S0婠]=`7hdIA+8YƵ\" E-p8 <޳~h|Knw sA|(ǻcDU*z`rܝ;i~{ݹȈ'[7wX{xOю~aOvrF.yڇca,`,$iBMOi!4 6$HZvI*S/,&rk_ѐy( :Tjj3#wV& 7l?cl`Sq0Ȟ/vusF~>N O@Bt+ݿ =3)dZSi|E ZPWLv8 #(W)duA4؊wQ\yA`x)R84k;nX0 l?)B1֛^t>H=j ' X`Y ##.b˼ \4LWv1ʺF[Ҵl(CUxa.`,s="(HV!ETR+ƈ#ܙX켯,Jykx}i9L(ձӋq~-qN3D= iYuLgsLd>~'`5/Í9G0|jB*aV+>ⵊ MGy )H^u*O]çiDWmE4N&U#7I%TaQ1S7ػ&)kZlp)t )ɽxЀK&&X,gO4=C,d i ՞n(@I8EB] ՙÇH*Yy9 +09 vQ&@|WH S`8_'&Ls Ҵ"~GN('ok1j׍Ks\S\ (9Bтaa阮p"aUmS:]/"5ڊAt^{) ҠNe8*UDș,˽.0?d>^|R4xݲ\>d Wۯw(+F2;>&bIpQ 'Ѓ_7ԔǛA*#%DK_TJ!#b(IlmcRkEF"/TY@ f,J H slDBW|FsCgZLs{3`و]-\fَi%]`e z ]DVI_`q dZ^K.d00sZ香!īb* /Fs KH+:y:;)6{t;̏xdoYU?)vV+xQKv缼X`ǝsD]>>*hlaLy4DWu n;q믓]=fKy[WFR pZ1%6uhd ,n'ڜ{bh$T*+CgČ$I#N{%rdi_Svmq8$љh0Bq8ux3$!>x IQ@c]Oc&ACeAbY8Q":A9A3XX 3D 'N-^*ԟD[QdW%M$/|"K&qUB$ B4k.cXۯ)R#M #sL5 8J~?nC &+D5t1:M%|9 :$Y!)m\!!"3YBwf쩫`qdƉP,ƥ3Fj<6_v<1a1`L#{FQgVH[@e3īH2X, V! ~xBk/f)Kw t_?E_,zV/b9f48X>K=UHPr'FFرa: y6A wT:Fɖ]!V+du+x. tNA#}me \GGsWE?sF<5MWp A{ءy''x!]G VN0kʂX /&hd 2 :>x"c*}KϵA@>﬏XX}&q-{ỳlzan%G9M2a{9s 2KV;&I5L|0Fl6)gDɟ 8}1bDvXuf'6*uz3Z/-xub2_ hJ?hg*|NO$@ޝYhJ{.QD̿ŝ$d\7VlZ#W#/§@3 6ݻqG˳-E@] ]I|i=GC`(/Yi3{þFf+h/fIOC#?gM7r2.>>$V?MqmaMbO)NY 0a5)b;iw#0\Z񮂲j#8Ot{v#ؠ,72xPOKrp5dgV289e _}쭙:JKK5\} ~N88'uٟ7{u2* ~ aoWkDL9ʃ ts( VZJOKJuOPaހ8 zu{!:mKɭ  )7!V'['y:Bj^ޡ@mMEo:(ҝNbӛ ̳Ta9 os L~y\E5Ǜx[˗Ŷ.a?킠\˧ySND0ra6pJE&_i-a+zipT$;)2 T z+2 aq_;D hxo\RU|*Z_H6\FO[~>Mkp`V핏Ʃ !+xm18dizo#.ۈ 44nLň!4mwja* )k!S1B.Z?*$] σp+1PI8نp 6Qs#-Mx7ќE*}4cO9Lcnk2W |s5OUR::̑/0i “6 a_!?i;^S>+{"{iLBC&qMLQPŲ+x?Uk'cHE |4 w{b/=Y8Ŀ>g۰k<wKRCGT<8䒳Kܺ3OzP(~%q!3f &% D.HvdŽAO3j \H%X41['˓Нb-@qh\lrLdZﴩK;[6v ߀ДZ88!p 4CCC^.rq+=o:Em𨓩EEw)/Q)\YM)@;QR_oMGγg;~ +a7ڋ@u!θj83Cxޒ<:4eyn]fhIp #V؄ͷ{t碜dnƐTQoY$/#pb2m ;lDS9aݗ(h%.M mN\Νƒ2f6>SfGv_ E/eo_??u6Vo[>fZHc7""C)|7x3MMG_d}&MR-!_)9=1d;@_Gb67yJgEHz2YKoj|&C5Sއi̴7{ITh$z]h\&dR# EFj6d%T[m5<5=F{S&L"Gex dٽCߚYg8RHg)A,,iuQ#Wp#L4cu~ ]HYjc\ܯ3oE$=ZsT'4O]9C*zӌ0x<{ظTV(^[ɍJ}+*`Ǥslsfʅ5U8FДLN1FDꐝ~NBv=cE YDt %A]Ԧ?4~)_aV)X"^/o~=1/Uhb"yD0A!G[Tw)E2?Rz_L) %6C<:BRڧs!15[͹/!]\ &J aiF&7}Ә*ÊPF+O< ;&6FM,C\ze0;쥾ڷ&g7=n3/r#LvE@ԸșWq D#CX !KR0[DB"Tk6^I"Qx++ڷOx1b WzS[,ۦf߭ 7댦چ{'v \-kff3Y҄17Srk0\ԙY1- [:S ħ%nrݪ-{Kr$f Yug(s-!s_xSV׹X. T<ʖ2qDݯ8/nD żG!sekBgnMc(_soK"d;&>:+$ ;1(]J[@N *}(}y\^Y]vőؽڤXp uVjs]wͮ=A [8Vdk4e$Br4L8}\dIUp)RC{_xm{QAIU٫Ե6 59Zu#aP\/^l H ;EKp@$520/Rb_ʗDs2m0 a>R #%41nن򧊈_&Pՙ:[~Jҿy'U/ KY?D3lv+6GЬHoMζ\g7 ۞8yd>Z ab(P.fP,/?19 簁Q[2T,¬}GBWo`t,-NQ3qN_X_Q(:JXMjnt?޼Rq8!2}[ۦx*5Rm:9E.ހHH~WHG*Ux$ @x'Ў֜@ \d\ ,ʅў;:/~!ƲA{NihU;>-sc1&˗Utyɹ2%Oib:\|@_0"2'Sk CQ:2{kF^6%$Lbmџ*MAN2pd !e}dJu(W|L:>(89sBVY/́WaG!)ޣ*GqqFꈊ /|//14fquV87g9 ! ߛR~6 [C}#t^o?)sxpFo7OuU#wƇˁtկYz!jtΥFI ŻgkS- gCt5rGf pu̩>ٓ{҃G:>l۲Z7Ec OSKZ[7i6p}ց'Rj( 7?z!;E@YyZ`R63~`屋g$8Bdȕ৵ e/X;jA dlO`!t[ҚJJ|cq?ZDxqu{7S^L~KNd>]Vl^ qr{Ɖ㰨LCu3WdPtKrQ 01ŏ\>@ܕ\"D/Iq@~jۯW٧0^f 2i]𥄋v<+`fx@qi!ɂ|x]b%K'A ։-v20HQ[cNY}6=)D b*V8tZhua s=`ALndX ~;_d̡3X;S{k>` UOm&FB nvo,eky=PiHY n/9fhzj/-@ĻeIE\9Ѧd`ACC>cXscmd JT,kx 4(QY!*G;Ɵbi.2zN\&Q1˓ rI5cvOҁ5eR@c% tS z)iy;;ȵY6Q *;(,=ˍ"w' EN2x+b {6$T4B 50ȐjF ܫ?CQwGFڋR66e A3 v-SSZ>_LQl#׋u Zʐ/h cHJݭk9܁XVDFitA0/ủf%^0; z.A2T<&)*#j'C!h"*!%ziQaV1d>4fLd98`k]jn#}$kP/_=łfP8?-qrtb[A|ѡٺԋʕ47[ 1Lڣ`-)דdbde\ #UFT0dV&sPNAMlt QY1v]x؞n식2Cp*,ȪЀI)e-UjJ8$(upepq^32I,0œ·IwiA#?39gK" +J j @1~ƒ_p 1yg֞1dמWiדӂ6ƚMRR'<9KOD9:7K9TS =7h8>)jdv4 _ Tʧ8a64JMjW2C㻻bd%^ZQM*<02 u83*/d%W QlxqܭHrrdLb\EZK!qJfž Yt947I UbXԌW۾7A%\ηڹlf9>m_0I9m IK&* 4a}0ET;. mʲcH*Qnk }Lt3ArꇻM+W3izHyQS& m-l2HD?` |zvk۔1l'[c p+'$%xqDǖSUa]-Zmw޹U;ZG{ꓶ +07}ȋSun2kN_$ema|ܖ5vc[ Nt.b[<|C[] g5X4? _u]c; OTsx JtHwL [DQ|3|XM f=|XPI.XI?%nkv$+YjqB'NF ?+8ť Ip~"z@!z V;c%L꣱A^HtJM͇[4Pl'5֮{h 2*{o甕5h$٧̧DyCKg}زcN/Ku2Dŋ8de/eHۄ: pW>*|RRQ\(y(o4U Yeu:̥ePh//yjue ځsdD&fAp΄fє"ذj_3`'3MJi@\smbKͤS4s&s&m'w\_6:GߐoZZ9}(#<+9IH*|џ*,>hD8Esk7>xӗb N`RQr4̉5X`}ģ(Zjf>GՐ$6+bĆ>k/5HSizێn#WiJ)JkbF'u,%WcAhorTQ# ,} H<mM|CI48:, |`eQ <(yz'2b@z"rKΖ׊W֥0J#~&S+KDtޅCFKcX )H:#]iE41S~a\wn0]_Kӫ 'XiCS#) BSa:Bi %$˙vR\_E=YmAIV5VTP^85'M1C"&=`bpâ#I&AWBL؛hQT4aT[ԏvl{]KΤk.`.*K#j&{3LgQzPwP4rj]|k^-_BĬ%SzoR>RJ=N.& 2z(7ԏ3v-}Xާځ=fTJuD:JPh"hCpgOXHmhuHkYLOȖY?힔ľh;Ԙ- TRoH+ҀjoZבM>$o N=ivjL^ Dʿ4*UohyB"\EBVmd^x $+bYF%sMOܛ]9s0Qƍɨ5Eהy1}1_NlHd4/ā ok[;{ $"_PW)hQ 2c莴%D^r b:I{*Ք]rOI&h7GkrHF9@48J"`~ <ҧ'2煉h%ԚOW2 2@:7bh2͋"?w{ gG\#o=6Bm x+G H$M'X]Ԧ5@W.PwƞE6cL^1]!!I >.-J סJ?_ 5ih9 xִxL`dS fptXC*>ȠHreGH;JtYwEL~8u.S< "l΁9}EDzPj6hӍPshTlFb[~Sۜݪ8r~Q]^J[k2[,wEǘwF58E0] ."]Mk,Lό_cn7`m{ D]O f:ӗ@q0gW1fB9=40bTXHH9a[rfJۦw& ]C@mA3pG-G؏(`./](LpԙR /ة’aQom[,0VY LRQ,@3ch+=*r=un1e f _#ny\!NTdl2mG U+M593S5RbRj2gz O&>uV&O<Ñ;-Z.~]69M(>:7JV(O<fKԨnqO+EJIuM. iLsiqI:B'fe"1J#hLV~ubcxG$m;cG>GU8x9[C8ZCƾ݂4z#2wpmvAJZxLk~ˍ1O(㹇8rO|-?cf`MZy*=X0˯{?_<܂fMw -Ta i¶PҎ0 7G}0=6*J$aJM<^FU)%&MAمVM3K? Rv٬bKDɿ\Y Pe2JB7S"?겹y8T*Ӱ$["\558>1rr **K -.~Ϊa b/imߢ{;Nx}({]* d' KF7Q#tÌU[QV4dmr$=NIH'dZc0meaBn,=8 䥰h "EfdydܚIJ", cQN: g@F2]oRJ^@E4uGݒ#xS39Sg;n^~_|UOXIJ.9i& d}B~}<ʻC?ptpPHj|ȞC3\WvYXd\K"@*e蔕sOlx$6}9B&w#MmaA:D;]{Wv; b;ɴDmp=;*ì+glUdp}[H@#Iw7jRZP(%$I=]/uֲ{uc~;w_NkO}]JuٴqUq㿒JКӃåX:-f-}_H6M?^w՟ucSnC (/$0>Ɩ3>_-tp?yo; H!zфwk1eĩ}'ה,/5l5y2p~QчՒFԝU6Fw]òa>,Ald[%_ Se - esݑ|Kxpރd3譟F.(JaK/fvo)c!3TGTwSLᚻ(@>p.K{].y O~U@Y0.jg +ڣ+zle.l U1bJF Ai?kJ8^l w͇/E&d2\|U}4E<zܥv\._*e3:}%?JkgzɟwHՆOmIJc\MsIf9]vI">>潢Z.,vBM,%":-vVa f5֔XLG 1MictZ!+Wߐ2d$,"}F"$m<[Iȳ ii덁xb:MN^H\WmB Zz_)CnB7,WGe}5*sq{3fGfbhvm'޾*Z4?@ 6zNSfGPrzHHh+ gO[aYMOԲx.}V?E>C` .`k0' xɗR1RtqK&H+-!a8Yhd=zI KMWս HjR ٶګ8fx m0ۏ_Ʋ؆cmv[}b;!BZ#4-aieA`D`|>9 .0LU!H0Ĥgk,<#Gv!Y+9|@'oBN%դ;/O7$ή]71%':ۙ.iWm`N)OV s^G^&R:FZm`235/-}kQ\ZXepG僚[KM *V NK/~,?EK]}ܒ׋cA$;8|BV[%Z!wz ^s\ QSU #LE *8^ށjS8a'#k4[هp}[ 'HFbq"`C=}-\go) ۅXxHz] D qhifǬZ-k!TH'+1#cR{9d@Ӊ`"I`$a,l^>f(/6$ zWkf[*YQ1bx?޳0/y^Ӂ3+đԖF [:S4gi١ML؝HK\~7u]N~!z $mӄR,7trKѯ[<68gAXOzlYXc]!ҏd^VRҿ0f3>{_DyZAU `Yblwт fnJX^Yzc,FBKGVYb=ho|5Χ]T/#Q}tNb[soMDt.A7iTc!b)f9Lekf4/4kBm?Rmø5qpBK \}Ov4F؃h6>(Co=G$ken-> lxf`wޓR1}){I5|]oHrd@>^%!UѢ|2 CӒ'mc&u!E33s_B%bSr{0 dF."Ah#rPh"5՗}sP 4ڞARFf(QՀ{}K-' "?>x0c!|זDhКF| 43xdGBcY &^6L\΀"_qrCրH Bs"D.":UOO-a:~egd~Z-/1zpᘞz :+4m'Ub>1նPsקczӣҊ#<4awGrq:q;拰+<ƕMRll@SX$v54&oZ媊St&'!'i([UPK+gBӢbVұI>gDp%NǦe\a*nyf]eh'巌/4^ƿO%i2a xG/a>cD7 {)1Yh:ɘ~)zpOA\#A`WG ZyQlT_ w71?q4 ,NPȎGFI,W ,O n,Z(t{pM=(l )VQ|F i<;yj%enbw)b3&`][z(=rvCw t-ڠFXHYJK&eG8'T0j5#W%:"~0`*qO^JZ;V-Lͥ|Ŏf\m,«rf'g8$@kv`jG`AN29|nÀ..KhW_ܞ컽(b&Lmɞէk*$lN4?\Pc.ٝ1lڡo}#Z~]\IVe;u wƫ5U m o`VaT' +j՟n8KLgC8ܷFl%$ry!xpyCa|`<[*}VͨajR-]˯K$CW0'"'Fntnj(J0q݅  孚 8]m^d Gk{IH˚.\I  5&Jxp|4.K`ܵ:]E?Hqc#fy=GMl¶ME~ YAW㻂| z/ڴoҚA;Vj1 ;O)Ԏ Q:$ws.7~:WX.le Y1VQԯC dl!R.KT9w ɜ*2Sm&)5DBKKє֎#ʌYw{7i MƷEG+֤*J6F|ߦ. >7 S ѵL{쩊2m~˽J+ <#-kzÇA1rX€BO/"Ѣpph QI V Ta؅ ݞyL@<^_ޣmeK2Nq>vK: /\ {#a7/Mm)0z\XRM\2Bx #0ؼS_N#Ő tB*cl\HWaLfYAG$VMfGq)lĤx#3*>Y.|W' aٶdqP>;R`5DXFN=*nc8+9& /:wnJ`o,a4P c\暎kgnZ̓$ #x5D0xA/ dFpb]5{!迍2 5ru9_V^~PBiǠMpQ(tÑq>+6"HㆺsAY!>'hN?݆NhoU$=u06/iw~!Mk8pE]geC 2-mE_;"c`- y8r7imϚ)^]U'!w((_U2#/Q[EK~hcڜu]nk,RI=xHXO{cl+gJ}%tepU-ʓ DeQi5z\-+Q⟃2b_8ɛ`eJ[O ScFe |ŵV/$h3_̲ez+6[XH,}]rt'o̺’ha|Xք<6:XS|2|[#噱g}L=6uE:PIP̕ƣ<ΙI FFv圼3]YI\6i#'IK9C0U]ԃ_r̆U=U}a=qhrW?{/95SR:1,IM +oi*&C#' |BwmR[}H3ֿG̫-u oy1!V#o~㯏q*gԃ'Ƽz|pLDkoe!!DЇGy'=[|Bљ:[b78# Qhjw&H3k)n 6K#ll*Ⱥ|9p~w_I. qa~U-hH"w@;űr͌ |=&!ΕI_>%L/#2YE*P{>6 6A1ʿ@(߿ &rqX!GeD)l@ōp S^/ hEzi ׂ?\1˞BA";kU?~] IɲX9 Fvsw^[5nQQz}*RQ7j1)Hΰ(Ul1e|;gDة} O>;>yæ;͎+Ƈ^Z]e\+b좖~}=bz)2֐„k.z̐bn 68LTŚ@ZK G,-}FWl*<^JV^''Ӭd Bcw?V9U9~4"'_`7L" dY`qC$aUZz=J%Yp7~Os0KΡ Z'r^ 6ؚ3jyKQv3z a-'J?joޙ ieL] K?jŅyZy e`a>˖ԎHj!>hb ֠ba=Vg,-VWoaDαis=tde+ ڪ|#@n+ijww46e\$7K7v")7]S,g$g2{Aؔ nU,־A_Me ;26Q S`vVv1ms]s:vNa9]z&'bK镸^~2M&2IK +z"eJBfϋ28]z1<^^սV㿦<}-}][lHݚ^Ŷ+OR~c$p{G$*iAP4qb!@3C}XY:enO p=_.aNJQj0ߍqȽΉixMYMsEgwe*R):cWJ{Zˎ\m,R VW?,)/K|}ԘE""X@bn~0{]_Dky~7΁'k~[]?ń[T!V?:.≓Wel xK\WąڑVtP}B--!3𙎺^-vQKrX8<ݙ'ՠa-LP-*l^ ܨth>ŽG;[UH#B.=B`Ѕ{l'MMs!yc5Й&II3&*ᩃq*Vop#~[q ObF\i`lRy\Ģ~\i[0~Ĵ- s< 0l\NWnKɞ{EE[|úV$ AܱB͐|#FrjEn^² @*!wCP[o&"E辰>2Q!nswxë^e^Л}%+C&/jI<{]b7qS78{N(ɫhzI%$n/fJ&7t.@_.pHI2 2&$_yU {dGbv* MfIioOi]GQɃY&gj{RAH!5 9Fh@gI6?tD]611N~v*%>4_poIЫoF 2!ϵd}n.vUsMZ]P2U>A#߰KK \0tE|dwa)z@E<=46߾_(pA?RDUY]].[C7dB 1|Aa; 25ܮd*twPb3.[Ŏ[~LJ;I&L(2@u|8[؆#y O{3Ve}:G]M gKD~b$,-h_m|IWC}\32&:AvkXA ./iVehۆG>5S,wFnơ<~ƓH qFZ=,)B6,7%?أY>ۚbr` 풣6UiY{5 Fe*(@LK ^>{;*5`q85#%U^22`όV Is%\OwĜ+f>塃!QL FŦ%aom)KK0M;6eط#R=&9~vR)zZ5g }֎`d:4Qn5 !#['%a5@sw1A$G?2r6httv-es& W$|Qaۓ̃mOm0 <h?ƣ~xuV "eI&/βI3@C)q~6sLdteQ{Ðp1zҒ Qfb1bZ"u%IN%W(UUg?6&=0NAD.mSlhnZe'$0-p5zQG=w @!G SYRfϟY4 @UIVBllbBYF|8vOA+BS0Sr{VuWSwX$,]Z4RۘVNjӾUdUB)h|֤ɡY!O?i~a$ vǷ$̹m"C)*҄U|Knu@sqm[ܯ=^~VIث }*JCU eՠH{ I8"׏=k{yF Fi-ʃsb20!Tb:d4BJ,\ѧ,mi*yMyپ4]32(mrR-CՌ1R)PE"D&ӹeF8C7:ֵrgOjk[!^B@ 1zYa! D^Ws \>)BVw6Rw}@%- O+wjk_V#Pgj5 8HH`(m~`s24IKR< vRv 0Q";% >%N>0(×b3)i'P賦 ~%V `5ćݏQ o?{_U z/j{mtraqʠ^~pF³=tav{9]\NCvP-8Um~b1Q/Ù$NՔe,$(w\pٍ1Bb6%s=pPzr܏P;oT #w\YM#by݈$Kk1(\|0)7R@WU݊X#> UmY<T|=e++!yǸGr</y$W& Si眚B!%VʦM f"^`K8,^}~'}xF/ɆC8RQtr?{Fή^sӽKt5g!+W9AJTLmU.ɓ)P椠kgxi*H(P  |W]ƙkSSĒ5U Miߧ[|GNY>a}x7pZu},en5{b̀ZSwlpSm֌YIѳ豻`Jё8^]VW }"4a$8^ĬZ+I_-Vx`]a#nd2<#n7.>sLy=, cjM>Q%Tݤ{R(`2tx 8oCs1#Xd8~^ds=<ƩZ$C@oX&}!oTZ4IXhM,giF# 1%\np]b1h>]4AG;`C~P>']G4c(1p%!qSTt1)Rk3(DZ%fgW&ܑ/`2r }(:/I0TQIBɺ}'4ِ+VN`GSة\RjJ-$M0./m80)u|O* j6;P}jIbiy.FtE&lFE6IFE&W6& ry{J?տ /Ռ_ Q1V%[Ad#vNA#޺;X5(ok?E)1*O%`sf/HQLҼb;G_(Al qw@4*߲[o@\y0Y]STsHCqhΟﲌ71sfP gMoy9er .v sZ1'qVQyacV#arQ}YҩϯE5'x8(ʷ3nTNQv7?Yzw/?thIGü@ηE[yfDյq:Et#D:R@钘wH.b\{WIBïvİX"Gdơ wz [/{P1R FtR ؖXE RB Gy1ڴލztzP_k<,K8 #LvxIJݍOu5Kdc$A89g^o\DP r`I>Mc^T@8.G7}iJWo@o nv1n'8JNݦ_M 25?/{ 4~4.S3xe Aivm(zMc~;A pW8|ڧAԩ QkðXS 8xʈX/ξaa.ꪜlb=Ju66pVt ,Z'q#IB7V`D ߉x'U\yz<`>$iboSHNŊo$ xP߀t ζ'Рd޹ ; !g?*3]fx:ZwU4/2"ёwv{rzŇnlV+C+*v|6ߡZoS tj;o5L󔚫,a>v wj m_ʏ_)x$MsVTS-;,z' $@sGfbDd^cw=Tϧ xEFMWf/p%O٤ 9a:*/Thc0١Dy JS>NB#}fIkcmGgͺ >ۆsBOz)_:2ەR4FV)0Ac)NdXRA~]tVN0BCT$B{{nvIZD(c|EVXUc.q y6/8xpĿlKRB)o;s㭘b* Ɔ%aѰ砑"ܽ@-[;Lf (\$C%nw*'8T,t?AҼ]E/TԟBj~,48ADG'^c`1yyéȶ7g ͜ƎfBs#Oll@zZIQ艴elܺ[1"S1(ئʋ(  $ud qfAh[J C'v|fZvOPgy,~%xK.蒬x4'CDI@'Bfr ]W!nr\v=iD+o:xB ۨy SmiMבm!I)6 b#I)ɠshAG涎?Zs`D[F ã vгDtE zEZ_!#IE`](^tLV%N~<(31\QQZ8ݣ[O@^-6┗łu V^y$ N0q'UvƥBFouIhsAU%"Z WNf^\Ь#E7{C̷^M`^{ȸ@SJr2m`P"q>c>AVQH!C[ip~-PSAH ^1 V y,M;'wyVe(˯U?>$5gYd 9Px *@G'w4d8cdi)4}:Cce?Eiб)Aq->H Œ;[2bB4Q4F|d0ou*)@lv8C[_&#c/q%{U q'ă4b~G:~XkEX-h,m%Ȥ3=ۖnۺ_m2^¶OĖ,-F|Yz7x^ ح!V;D\u`tE_Vy^9v'G[;RaJD_y.*T>@e37lͼG^?VC|οKL_XIktJGRBx+r0a Va!'".ٟOԁK;Mna|'I@JҜ}3A=%tRJ47{X_v ج wpbG q.Gc8aMuA#7=C@8Sa?J6 FLHOדv}VNF*h]Kۖqc 46GÒ@w(Q^S=?B5;/i؟c;nXkjr(-~R1ƿ =Ld@PdSOJyfdlU*tK:x*zޯ!+(=DZJm98EWv[961.3%GsT}[\3P!? i)TKnVYK/\ 3*%B!än\xw1䩾WzY#iY"ň:IX~4>-QQؽuUȑn6l;Fh@S}B|PVGQ 5ꑏ\@uюiTHm)SYdn<y-̆ aRG{4OƱ>,C<)H_rM0o[˩S!P0(X H ,0ꮴ`5ː 9|B T$Db}tRJ{|00laB? 9lr.ec˧5|G9xܱ )g CUB8} 썠>^b-Sb0S/ m >|,u>H:I:mc{q+_%Չ1Y*BsoV:  N/N>Gfȓ.QKyDnX˜ Q:*LrLwI1͎?.c{HTj:^q1ph]S!V9Y((R\K>jM)@'u|k&bfCг:XKRz6%4/ԾR ׄ@@ڱۮPaDrs9S n"/`VCD󚘣( _3mҚH&ޒqiEZj#T]\K(By)NYLͯ%Ў>ܻz:t4:gUu@*sc{OQm"j1}4eJTtWV͙{5'<ة \Y뀺ʣˀߟ0 1eG~=`grD/b*jhoruXu~:%+,+Jl26'#dA uI1E[nz{r.*hۏЬfT<P>n&ʺXB 欅dӠVԁ8=5<􇙿l< OJ9 &mʝb@ĜGCUb_GL`OgW`5~O>N"brl ~wR2|:)`[G"u8RrHi6P/ |9~JT\lYA9oF) vb>-`=!ۨTOT;UY!8Fyq kQq2VA(aM'[ο5нWx?` '5 c]b^'u]bYH{Xcweu:<,P̒ū]W+B x+ DŽ'gAǔ(E$LpUhOnw1>S'm;(*U~$I>5>\dSOlQ Tk"dġU6>0bvwG [�$ .hL]eJ=$!d mr8Z".z mW<[1eKYxW;uM,#Zkzqm A}&>`U!&E[*HWW5)Yb BHElq}ْ&gA=s܉8O,U? +!Y4WvG^R K_.CUPx uȠxf1yg\먥4*%\D(F.|)05cn¹(",@k@Q>\7Ȗc+?epE_829{^!(;ى*)RA_C&~"juqLUA*^aDܽWx@ٻ,}Q͑rv4n]WFROI:DpOBWϰ3>RcO̖Gc4b#Wܩ?;ID5WVW aF^W}Ϭ^b7eJy-0NC) 61Nq 0118 aj7ԻHέA 6j캈+1ycH>Q`o%w9[X$:7O3U|تXYQ0%=S.&"e!cX56`<%E-_NllB7|yӽ<CB1yU>$h߳'c2/k lySRZ( Yw2~pЫ{;;آ=%؀G{AjO2l?W3*?eQ Ñ=\h4yCj8&ғFې2\:h$'KLV}ЗCm$>O&}JQBgCY w+'k=B’lBcZ*bckM=FH$Jo=}` d.D`- Yעu4rډ@"~}"DtTU9[uq/Rw\CWu+SDTo5 9r+Wp5!6E7M2Kw™ ZXdse&xr. @PtT.' 53f B | * R^cDvxF#n1$ Z$HAs [zMGiUwuoG)aDUTk_Jv%Um;=~["#,ZorHRD8}:f5hꔾm]POqrwɃ~9YR=;"pZгszk 5[Hb=|^Lߛ0Vb Ы7- cSIb^j~qMi0/*'n]J~9PcsO!aj.DӀ)2T@>0ۇ n 2 R{k Mu]ٺ^Lm??W|{YisK-}jG:{*J!0ҭ-LoK$Ro#-Lϲ-۹xj}ݰ?Fbu-;,-HD-;v~+mAku䋢䵲,8<δi8}/y&C *GzA$+籫>7-^a, ߃N̂W:Nvd[#/žmGHO,bNBa*4+S\rQ hO9]JY6 ;Ȫec^rof۸ItYAǃ6ۥ{=DD/kY1%zT8܏Le!lot=(Z84l$MwOd,K$Lj)fP7ԫYa^H gV7hG<3hSD-˦r-1d`Z.g$`^aʩ5$ߐ;y>ݳ6F*|IԲX>D.CH$FİڳO* UyG?Vk800wd@)X GM{p߭ Ou\K{z!h'HbY[8-JX_ᨪ[6D*k 5t޶|tl Mk:^ jbPûF0lC$nhbOHJq/!ˎ<] mU z zoGW$FXX}:[Cǁf^[ky1m58j&g*84>G"uswY Xw:9ov]D"?t3z27nj/X͜O9\Bڠj}K#ugukTivӝw:ZEI&_"V+< GhSxċG;휟:x X;'r &,_/CRTqPX쭦tjDBFXdnoFrNg9r V6#601SLMYppvL,Yg҆T'VЇ+*lع~d^Q"yvwg~nL~$Um p!@YyCtà㘀S i!6@>'RHJ0Al2%?AImM&ND:0} r{K#3u$2B9zOD.TƉ͇ݧ ~N~6?鸎|H]N%sUT@ICzЉӷ^V6>ߞiҝR^0+2򏟒^a 4fȫ ;eϮc!<Ulkaʏ!D#SAO/LhBE#y;yaevcV5P(OHkJ.qmVSm+Af@33^N)exK-4mġ-GQm ;I>8tn|:GfBݩ|]K +H GL[bf/ 2Ӱ^)OQ }9q5+('[> ¹}b{*95fDlXin}̘@%^|қb@ßQn<;Z%zjGh >T .ZIlbv&+6FG7j؝Q1cȑ.N%x̕:D4,P\C?ġ\BwGՙH%K[l>U}XWȔ=p»A{cv R~5s~3JU@vA +v$-2ˎbR\FOk[X1 )kYXK"¹^E0VapGNM1dƱF,ga 0n'I? c?> -cR3V_X\:=dC`'Ƀ).UEaa j鷖㸜Aur +$VsK<۹a$e{b6#Ժ '/J=rqt yF8}7B:?Rrrpk2puz ٩J` 'lg6 ڎVT| S >~C!buRKuKҰ_зVW"^i ,jLT١'Ce|<-W)>lݙRys~=#Ҳw| \7|u(;nips3aSS{ vZ e]s dVyЯR{AuWz:(>۷sq $~-@HǗ} G ?}KxP G$^U 6?RJ(ϻ?%\:,Y|d41ldK :ڠt m 4LYo]ՂNضW=ӅU7881ɵ/ghp}j9s+9XpZ#Bw`#VQ~ߏLYYdˀC; r.² qRԠw;3\͜[_$L@%iM]%Y?©E;TkF*Ac'Q6G{H5Q6 KM42m͘3K"L{0ZCfspޙquKy0KuIg'?[ AaڒXջ#:Q˒mZ @7o*ޭ2P}u o9ojyWNuf70ѧVZG$QN e@@!HGl~u{+|ڍ" 6ve3Am]wݥL[&> r/ϐh>A #"hj߉^r[0.ZGl7 C5UF~Z-{q] >NNj˧1+:K-I5wpr#<3L&E7\ėLkr3ۮnYЇ㩑.zd*k D- ^Lx6r1nwK ei$8I##o%d޾K:pg+o4z88)clO-2}Lqǩ/蜷%oc `KOJ7 WM;-M(oW4`c%kjXd^>mzX,!`g4u.lWtr.Ūb p 4 3L//|t5K\\h-{kpsRBvG@ $y^7І7j7|au/7EIf.Zk@G/M(v\ {.y!Tp~7PmpF  _j~A /uޞunj ݦb>9z˻]B,#pY`ׅ-eVL!#omPQSFd"3-4BT8!" Z$k/Fmԑ.Y6tZw -#] *'d.ô(Ey*AWRn q0 ta9D?T' g?M&5QN+s{%[N%ĔP z8'\֌y Y(EkucSL*'Np \@y&%^FO /Hx;C2#GlUCģMPP׊BdN,iľcNxGA4im+)zhW׊(f~' *@=ZB!˚NM8=/mJ1vL¾-؛ &*.Pq0ks O-8eN!pGoN!벋 ZƏbS&e!}Kf MZsrф8^Vdý ;ٳ fKA[7S;xF){kE9ZNFe7pr[*sH@'G,J5P H= Hr~YXMy3wo:1Z'- "*Qsm+Kx3 gݾm truH`8}RDRފF(ۇ,nfF3*Oc-(G/w^ Ֆ刜 W `kzh\4I*j;_vm Z3 eIWs!GF‘z:6vÓ℗Eieȳ8Hj ͹?+~u3sＦ8TQdz ү:AFc)'A `][U, cT5syyhiѵ6;LTD?ܹQ$JF#BM7Dh7 kTir Lbze%i#.dAUC3y{ϒ?}lV -?(ś[TN`rT$ 7j#2b7)/mvQ:9^v5'On0 ZFo~]G\٧:-ԐvlZ괝`[ 2  й /ϷRcFp~Z*{^fYJaa =Ův0p&*kF=bxzMd9vHH8OvlRN9>mtZ뙍>$oj5{L 7 2TZ1wRK!\d X͗)mRADi=g,iD။<Œȓ#;>? >'MDmJcWKWDᦽMh…b!Wތjg[iuht]gHzp U4ܕ.4%{:NȺ[ y:)}FM{z]y;s")WRKa/Kļ3oQ$Z֠F~X;4Z MA־ig߯e(nxlTK&V,z>V̲%@GY4^>|zPJ?=-NvO\>kgϜ^9FxQq)7؜=ÓJ mPXWAjUv)?{sMT+@2k'xW6eJck1aCMkGEȞ[Lɉx+U3${]7ZTz]KxuÛ[ GhWr(ng^DW[|g -+fB1\O[Kn#A|͋=APq *8/shUʜzn *td5P+% ,fbvv8Ţ:s&IX͹Oީ驪T7/~<8F2blq}{[_Dgl /2?eCrYds4='8W%݅6)[THzPܹ߂8ھ`r!›f~FSԣJj& .25 -(B&+^`n$š7;J\Y;H;`&L.L$˘u|W8C#À:|fH> F<'ba4B=6Pf-AlzK~/S?m}ȶ2Q;0>Qm U/~Y;c㔬)A6B(EdEŅ5ZAF*3LYΝҢ4.+hKBOi%u Nn\Fߴqv w xW@~;8`*̵̷`G84XP2G#0=骴 :FgCѾsG1oD= {w͡{zC*rJ=Z#Q":7k0>[mG3ƻMˍw_^&QI}pK&T̷4Ji#]B`cJXs/d <\WzAGyW (&LMu#_V= ? Yeky#/`O%ICL?<p#kF+}Q.?KP'P/ñKs>csTx7}yٌsFs.<܍YЈ0:EܥEn8 i>D'gEatB^ r-ˤO)Dd+Db^s 2` Ew6,:r(܇$"6wexډſ\~ubvTЈ)!' Kb&)p/ftZ{Cu-T SzA(:*а #Nrd((b7* R:V)?ifIA2?7oX[a_|faœ4xODHa;A_DڠK&QfLŷCPH m󖎇|ߧB|4h_=Anݗ3h~`-F \~5u-R3Sц|sV~u%B kYfWT4IU@M䞂0x\k蚷 _"'rVBW:8.Q 0@ hW)0D&(aҫ9EByr}F@%tRYlTKcI frg j^~`VFXȝ,WdgÝeNRX<pBT:%lt<J8B:Gr!6&ec6!LZ{Uc+i|L*,wXRwQValzޞ#M6T^+%43Ui"oRXrӁj}&(\_>6kRks~7Mqet+u%OQ6'TwGukMtX덞\['b>7 qeH&Υ9oɕJ_FMD,xr ?wfR6w7,Mz׋ƮarnH  íqOZh)}xпqHua=DxCn=~H?v=YXQQٌ@ҥD~i] 4Mn[BZ&`3FwoOaS:]DVM6u;ſMta ~&YBlYAFU';NhkM=譋k'úa&n oxmQے"flIlDl S^'B3H;ivx<6HEHgaFNϩ #̳[Z,kghrlwas7ӥ䛖= ⚟Dh+LFmfT~=YIWCO bk_9I#iڼw$|5=sogQr\m`c>>P}wx Dc2|[\.ӈ4,צǵ=c61( "VqIߩ7"S]8xok0 er8V˩`Fd46YPj;+`D7,t&ijn I5 vm!ȨW|:fRq# ^R%J!(51uhmMf9dt5OI#t/1`Ha5q6*mg$xuѡ,ò\DFE&7=D:¼-Oj8gF*D)|QҌvndEF9N9YZ 1 }?:Zva I0)Qr18?hqbbvV?D3_KwzYm꨷J,u~]gPV!u|;gװ +]:Ҭ~d~qhSc1,%NzzNٔ#WPǪ|`՚7W1AWdR`o R6bs[ێ#k U6'UT Ү\}uXv 7f@bαVY#K?2Pw&& Y,N6PT)[B@ac=Q4O5lRqbTñ̜>P_BvMZ|jea VoԺ1O;2~"g&/bE7 Ԏ)^C0ہI@ݕMޏY;R'I޼w/Tb> p$y:z.츯 ~h y[y$--[c! MrRzr04k:e2_}>зf5K1qZW! 06P.6 JoZKF&xܼD{- ,_tRDUFJ|!ڧ;_S۝Rl$$Y)k^2AG{y{Sh YTXXh:TUYyV52 )Čߞ ڥ⵷rx)șN(-rp.QI<_f<41GFuMž#ByXQufqL`Rֹ3Ϣ |ú]0נʟS_ȏwyr*}zA:LE$CC}`|h[-Js^X+8OK"*I=7F=XX~>t.Jz2N0QelvI`Q*qS l丼(k)}DUY+ʠ,>mRE*zkjukүUֲ8͑@pz$Ë^8Hop1?TbcW³wuR ;.B.&JٔAvџwhm OnnlyXỗMLG&gdYEL 7 EIx?@s/@F0Ygjކ2İ95(G2ˉTL?#~c+6-g X?WYqІ$]U!yйϓ%V)JoYW 0ULBIvhP : ~tYբ .BL2"xY ~f#ۯeb?j_] iL-]Ft3A=ØrBz>F켊Wx̥7)G2įm'^^wk6ftcp @Z ![3)@8OW?t׌ן4=tgO2q_fnztksEFic)#8Tw|\p`鵣( +>^߭tS1aiEg݇ ,N~&֪΅֠b"J]EADž#3Qd: pɿ4:.ٚ#]plxe+) c\ B3Z}ߛDcn:dHHY7X]GSb}P>@=Xb_6WzVb`fDk^ ad;*娸0Tj(F>x[)L[ A£liUPr 4޹}[/-yeFR)-_c##&js˲G#ِrp*u]EofB]<TNWK-r,"`lU˄G:*Y8"X'h#A7XpNf _V{Or4=NNIrRlǬxFRr2m幘#.ahhPJo%L6(8ڔ+H1o ^bKZ7y 勒 ~1;CS]v%bs셋I;.dWnP>svźcNo G,T}t"rc&A e:zBp y{ V*3b:jz0}{\ SZmehÕߢMHEbn)mktoLpP!w(no0 d"E;-ު+]_A6QZ^-E?`~xOƟ5#X܀~C 2D@80ÞoZASo'v ׌4Yg>tk;hMO /xd( xǥBJ_uV+:< m3^`%Fc*gBnjƻӱ{ai].+ 1V~†zTa\D!c5DaVHI>l1gjM)oj;"͟ lEH((s!;4;H^- ^OO]@ &f)/C*OV1{l+N@Ր50nĹ$7^,L+"PoӅN}CI}QgF cZ\1r>̬" kUᰕʙjQDh\i-K6+J,&?i$M}NXq"ɕfTM_o]|4e8~h[43G*#4 $U Xusyט+mgtmѤ8"k_'QP YJ(\E~[eXEIXbG|ŏ)ZmL FU4 IĚvƼg_4WTE2Ǯq$[E:\Èe]+*8y, 958S4P+o痗_BIUIuX TSA|mjLehCwŴзt pWr̴v _%tT[~MAL=$vEzdG. #XD`{!m1Zi-#$^bE%33L ' CWvF;6mOH I,!Q&aarLi{^NjSETJ8}C?^j6e(jS"Y׻FYHm${e^ "b#z[l Y ȋa8,3TЛ:Wi_iB25ǃFx8 b; ۷{.%t6H\\Һ#vkqVޗL;%sjBTp(v%XpOg7z)w.jvNǠF=^nR@oJ:5D6QJ}{6ѩ1ڻ|j $Tb7OarE?& 1E;2 }HӛP.r#mD].NO@ 0/ P=ލ {nCrJ%)y(opsS;%ax4r[h?ӖL\K,"A_.*]gfY ֛-dpx/Ok|_lT"a%$"BgݞM Z X`CHa#}2A#S\q 6jTXM81 @(]H^}lW\5>>DW.1y.u6Κi3 _᫦qmJZrODž@ ݵ3~~ 'xz"5C>h[`U9˪,2# :ۉQwI~B'>zNn uх-;Fy&R,+q =< lH/p~9[X g,4rQ "eyZu[Q/ ti 6Y)cRedLjiZDVyw槇9Ϡu\ 2yfbS \/MMqec+߄#'|G5M^bhjmXmz*m_s}\m},CNsG4Y!4jK_R%n:G(A4DAx4M<> QvfW}|CvȔ*M\5nj}CZ k+}dvT-<1GțY(6]( ްIs&- ּEBVa4B&l9o^|W BȿY 3vϠiT1vctK3cyZiR6",8@z킃ߛWO)1 V=A`rA4DXA}E\na8Uo&KP[)&JufU@G`RڌNqہ}ry\@`62x|LTA"'X9$VTT >'(2n>>bg{nC_L&V,?9t?xgZ5klp f^ov6Q0n ;|T \ x^ srE(Z9>2ޡKeB'424<D ^u%L;曒o_.s?3jˀ 6 ZqxUbhHސW he@FixLB3 zhEr>&8vX1Oߙ)35nL } mEyt3,C1WIg׭)W#DG 3(ģz40p!H9 k$.%](;%Ӟ:.uѺH @3XѦuӕ[bN^1V?ug|Fס%} Y%,Aa!P/Zo=g炠[\@-< 7fVW-1qcэQa18 B(:{LqƿhY,?hߦ<ϑ{C˄qE<䂊ض}z?P6 G뫧0mZ2?9pd.ҺW/[[wJ =6J4('C ׯÄ_!@ ; YZ