wpa_supplicant-gui-2.10-150600.7.6.1<>, g!p9|'`B5iZ)wZB,H4̴[x7zbleFflNQstڊ@?+@~W1.؉ s0)XsIТV/+!3oD<»%u]iÖ[PrO9)6e_r S_*x5iq8\ͷY$_s̞iֳ[WN|EDKjvv5 ijA2wd /M`qL2՘N>><?,d ' J , BNkq|      *4`ht(8+9X+: +FZGtH|IXY\]^bcd#e(f+l-u@vHwtx|yz(Cwpa_supplicant-gui2.10150600.7.6.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.g!h04-armsrv1 SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxaarch64 큤g!g!5d525fcb234d87c55ee3beaccb03bb4d2a179e783c962ac155e5c6a6d1782154d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.6.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(aarch-64)@@@@@@@@@@@@@@@@@@    ld-linux-aarch64.so.1()(64bit)ld-linux-aarch64.so.1(GLIBC_2.17)(64bit)libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3ge}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- CVE-2025-24912: hostapd fails to process crafted RADIUS packets properly (bsc#1239461) [+ CVE-2025-24912.patch]- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)h04-armsrv1 17418899802.10-150600.7.6.12.10-150600.7.6.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37861/SUSE_SLE-15-SP6_Update/9b432eb1227ff88675139bcb07b9c311-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5aarch64-suse-linuxELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, for GNU/Linux 3.7.0, BuildID[sha1]=d20254213079c98e89091bb17349b31acba57cec, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RR RR R R RRRRRRRRRR RR˟QZsxkK>utf-85e7624714779628126ff371b420bc2837937a6f75d573055737a6d04cc29241d? 7zXZ !t//]"k%{m{#rD~d tGJf͚P 1?+^JR%+cN$[]/@NoͩK2ĸ}WAWْ z<&vf|ˆxw`!|wg O8ʊlP!2:t$&?~1BpWy({-%N4Sj-llԳWIf [K:fO eΩmo3R8S6?wL3;8$cī=T skt諂k#v!AC99q,|s 5ZʚgA[V[eq"kcΏt¿^%񀑂d8b~Axn ~pym+༠ !ǘ>@5oi]i=9Y^>c+F<9m3.6[$?˒V_xKeLWɠ\-}7;RTj6RoRMW^&2P܈-c1Y %V.#1ժXђxW,HV'7RYs9%wDwo7q9u_!8k/U^QKo}Q$Xp)t" spJ.ƛs,Hҟ,:" [Nm2o w$wcGg=5XN:DZW$d}ǟK2|'9 k.{SߕLH:v@Lm"q#p :$%aΘ!jCe=!Zs$e#/F@Gzd:PhQ/U4iA$҉Wi /$ɜ8L?v̏e]$upS6Wl҈22BR֝{dw$V|Q.Z+Y"VYrQouJ3T'8Ka&ܑ7XKZ2踈=?ߚ_g\b+[%; ^a .ׁأi猎{lHc&RzR& ܱs[:7 #3YQ۬mQSƤfS>.d_.$~vwXm*x8 |BI|"$̒f4SAI3 垉v ]w_n`Mç[1/7UoL t{gA 2`BXW1\#IHǓS#Ў2d *뀰R+?ѻ2॔E$*}J% lK8 ;-Va\c$y!sMb!XgX}4Rtxn zb=$@ C!|s;[9ߑz tϣbB[OնSAQsvi{Sf2I%G7/)xw7x:}IB"u*0mJ[{GC84t\Z~y=/ .T>o6- b, T Ըyo< smsda)MBfB} /@&2gʢ)'֒7==%]V{3k?UƐV͖ .@?VFEXxݱnƜs{k}a66on$%͸@yξD;>2EM jD3c]T1+R"]5Rc<>+HBM@Oh`8zzd Cܒ/N9!. utKOr\`FR~LwLU1D毭Qj߱2En&P^6 I < *&RWF$)S+c@~1˸LFj搝22]s&UIȳV3TWHs݁i*']3ҵs2vl74!X'5_5WfUQXu p|LJrϽ<LoL[Ƌ`ȕPdAv02w^` 3Cw _i WBj˧q^N0rlPhA_O'w8ـ;xR)mhvc~>>_힞 ߭`.=c\yYzqk45ة(OS2젓Lv_ E03ta /;@ֵuu̚- | lTw- ԯ,x߉-r{o\"A`3#<+5WԦFcXܺwd9 ۜBsM]/aPL 6TZH { DoyMynӜJ<% -$]s;A- НV*BFPPП6IAZKPtqŵc&?aoTąZ#|vaaAeD,ڙ!>G[@쩨Yb%dBW%ViyfYٯs84=V18" 2J v^6#mK,r5$VN9'fjDLe3#8T3[Ȓ5yy׷,GPvQGD_Y$dv}y:W$s)- ?Ϝ޴y^ !>$<潮4w+FOVWಡT{OR͒2ߖC렷 ߷vNB MkhwL_1t OKO5GKYu& (]KwMbeN?sD zB > eJ,ʚme)q~Ȣ{&j5) cZY|rX{Iaea`i?Gwm%&,3Cb33| Бx͹zQ!m9wdk呤Zr<.=H)Me~!bP^OTLxfLu$|k5xc!kԮBwjsۜ1p}kBS}#^/rD h\*ֲ,N' s]4c/!TI4xE4PV),BABxώ zRw~|kYpyx*f5gajZ!G:VŬvCWVHw{^Gp q`4ٯh~ ܙVtU/m\*B2Y`;K bڱW6o6x5D=uK@0/ }{-k{87$m|2* !>mC*|fpeEQƒZ-/{pԾ[U1Is(F@6s]92]3 F-4|3xcw݄VO|X80V%UU6Hv7DaӢ )#:n & } *+9-qM%;.C~z 柘B%H|Cc͝1"LHV RhDϷ0;9"d!2Ȕ /rUmr:'TZ;2\imr#lB96g2tArt+=-JS9˲7vKS65Fp#[ՇNJ7jzAQ^

pK0?w(N:RA, lŰI؍Zi+`WO6/3zj,lNfkež:F3p^'\2| W5E'Q?w@EžLyc3>F=;1,\|a`̸ Xh fN[d)2Ub<^{T 8?vd4dOm:6ͭfD\jQ/]S^l J%~&e0CcFy~q=ݩ'*[ɀxp$C=4#T1U&Q&Uښwu8>M/m̆>#Q|ذ"( ;W: \N7pgz~Y#V_ΰ糨9{NI\q䪑Jnq9sin_i>{[)${qX>kF[׆ѕ_;2 !lF2,04,lf]cTn`8@LwgE,0ր>K4e4Aw' Rk&yh}RK $l7)xI?{LDYOeT70+X$itA>lUj B fRZP*^ä^LI \Xљo#2Md4Jp]Lͮ52v\{\ j*@GMl[guORi|}4jtfe2lb[B`߶Ν;зtEE%EINNOQ5laZ~i!uKRL=/<)f Ĉ~݆.)c. sGzS|HH76Q}|H9{qXN1qT8Fݺ0jr*0Uܱ"{wgA;ư˹\1i.V Th9ndhbJpd>G^kN~頖73qZ wNػ%[yO%}# *u-dCtlvF7(SHK$M6ZqϪ ]K zwc=ӂ'JF<5'PZ{"yI*aSaFW<:>^YetfZb\%9JV^4OzE;˃%Atu^*i1̀+Qu#{8bƙ 8EsoIF-ht]RҎ m=f\:gHnN~ EB9:"^kLP 7QSӛkw@}~ A_f}Բ̝UDG4c9D O^B@@%3[,=/B?i2r .zK,UAi!˚ bZi\ (Z$FkG]d\O!&M\6|jgf,]Tp{E;+qωqK0 (۫K Yjw">Ek_ Jy=<>Wq,,fNGz }+DOY7)^2";lI`8b=T]okvXuc9е?eK"l˲s+n/p}#`uxvV"9PpYb=X96$FAƶ\++ƍH)Pwb TPTS51n 1oEN#&kZ1FjxV:N1̧tJCՓ&^;Y2-u,&qձ\!ܐq)mM!!v3>oYRͬR2[|7_tC`o+pGJqoGH׼GbIH4@}!|䱅 [GIQM԰R;$QVb Fi#tptr҃r:ؐV]$!"eA/CųQ4{ֹzM0Jx.9,8%I{lҹ괗t=j" m͖J2z2S6{"ׇ[~eG*5P)0SE S4FʌkU [*A~a( TQoUڜ$_;V}3na% 60(AU(%Gm5E3)1>$﷤ h8b@zG-`_@FHh"hؔ_ Jf(N,:X'N>qѤ)~SaG$}8aZN$CJ$5t̊X&˛2iS!C$, ,) h|[š/xv$v209reE,BT9GQ82UƖTZa  x '(5;0{'5/KFʟ4l,\́0Hɺ7 q$[ *m;GU8 N,Vg?DڂNXii.L#ͧؕ!|Dq_Ľ2Vwzy9D:^|:Y ^e/+T,EĬ3R7=Ϻen_;CX>,"]_K֗g JO0Dž1\*Aqu'F.ydWxǚR eWtPuT!v544¢.d˕G .B-2wtp Tx<>֜P[!G<~)5D?E@PLлtY7U7P`|ʫW[= [AFs6i\}5DZxWvnkF_`xPpyǐ9adZQnrh`Q+w f8wieTEf|ͤ|[PTUnhVt s*G Q$u@2c!`ܶET-P# 4Ȁ48` ;(ৼ#̍l-GoW֘E|:R|Y\%m 4};խI-M2KxGCՍ 6a&ʺE6QB  18o_S0tUzuB'=F(1PYP,pz{w Ǽy~|1O:_xcR$fwrC.V573F2߹g O-[Qmra}@2cbHf\:$^/TzõE|äD)~fYPuH/(b+n1Y" 3XS#za`@r*>@z_|].Ir1[R5hhyI+ǿpݜPג#kgy/p# xxa !SR~yDl Io`ĭYxܕQMӿiΣn'W͉- rsb3qފY`mJ%"ށRZv+MiȲ.O 4oH^aR,|xlq6}P 6O[ ])fQ <r+mz3xZ^iC*ULB}ް4rQuz\咆fz-&Ub}\z 4pݻfcP6uNmI .;8O5_TXK9^Y{n7UlzI@TP9'VC ȵ::Ҏ4otcI8 5W P";‘ :-45oK[S7giJ26I,K d7~'.L k:N?ZY;^`/_X3-Gؐc#UnQF+&-#ل~|YB\ƺͭ)1+*7ibo ^oEy;ͻ.BJQuD:)6A]]hʨ(i XVb7tFPPKT0wֶEHDa&#FѹF9JSc&AMk`L!pZXY-ۡZR&sPk|' jܜuc #`]Skl*cĴd`~-u: Bq.Iv>nW DŽ ܷ44%Jxe&,Q9MY;Hv5@?L{ph)( ARŻ1hh duXȻMᦢQwL;Y<08ͭj.ANm߈̋lg:9ߨù^^9] ୆uOgȍ.Tc$9Ǣ6(fnҸiٓPW)* cVN**De8e)"{fn\||/Ljea}T'Ĕ^ AUJU*II|ߝUcΨ̓!! ņ7Itco'M%z3Zg# P@),!9D I@z OcMrE*pwA U95jCggM#pA!(u0KށE=BI18++e(RXA%FCQ OI$B[ST=q = -WԮo %g IӞ};%,'pNlQ)~VjbeH1k-r_9dX_lziqfxt?xۨrIPF rp[ aSb2 D&pzO7z^FJ\Nu,c@k)~ULXpRND c9z'RC?Qd,AQE{5En, qRC#ň⺺'0Ux2 lyߺ I\?l' m :D}3VeWR 5 (aI_Wx6Dd-_%i;:?g-0Y1/)dy %DDEI?ECz^gD"j77ce*k֫]*c6(p~_Tݛ[Oe\ap=c2@dZ^?@:9.JN?#L9 Cv uG%~&|,\TE?Fm9 a`[Qah\)k.)\c|V] ˨|eԾ6b||yrEӀ]QtY5T+{`&Dvs5=سKb[Ua4՘g/BC2gBIV > 4I{ŒE$ٸ8PU7==&2`;^퀌wcn%9LA.+dp7cfe]ipXj'):lU`{~}IA3F/G-Mz*FNFlISr0QA,aP쮦mk+7VD0Ş%iλu(u,V~ge[ c~EwXy!6+xˏ=denA}gI*e{aV[V1&XgꌋGBĆ_B v13'?)xI˺\]:RP{네 [>iX| Ɇ_Zʯt&c \>ٿ93/5 ܪnxM$IZ .؁s2s T 䱖ɖk(9 k{}{o.ym8>BeDs=)vwɘECuo+[kl3@TD2GLoC]Cl8@e ԷGL ޺aBW%n;Pj*3V.) N0[|M&LjNU@$RƠfҦ@SB&ݮz QY"P@ g}~%8meYW^_sUGJ^A\^[ -D:q 'kUK'I{Gʛ_y<""_%ܢ,BXʥ %N#C#7ÍfN{T&c_?0_ 2TB"ݖYdek儂릌b'AFʰL~,XWC!|݂+y+̎ Rč[VWƗd@ g>wӜZAtkB´\g0\WGf&YDE"^szbE8/:N .?FfCL.Qa=_IJ%$ ގ>F BSIGQdZfkQk]uglui;hf3 `) ل eeժz:(,ˆddžm~^JΉA 4ڏp&YR82&g=?o7Lִ:E .|m3"Z"jՋ&#lKeVɉjk4ZЮo@z}f9%~#ԂH.x i2Pq24.I:_pj>݊~P V#+B fz'jz!IiKCMG,xtʩKPFl 4sGipr3Ai a Mߦ;dj!9-5c.!eL|1S{3rJiF:_F q$F] |7&%8{Y$f_`z̏(N"w'o/ 2j?ZSH@3\d2N( /s o~;gip,*zf­pnYhvUQ՟>3n }od/e%eiHы]p\PtB1PD],DpwB`8@V\0DT3H ¡f =r+٦\W*U_^hc=ёS؄˦1(ݑp֟N) 6ԘH(hORcW6u}j0TY_ ĉ엪gD OFʤE'jui~AzC5`xbVj]:?Z{2T yЦ|.(3lmBOSЙh2+_Zq?{etJkרD84%pk9WAUY VFA6/Gӌ j v1J:ˈIᘣRyyȠzaW.7ݞc L |GҚf|5+)=fֲsmcJ`zn( ?Sr׷jOTOOO=hWgĚy4"&ؕd>cYc_p-!~Y?BŁcu*8L7!B ͂Q/eef[Â>PWaeRi\ٍfJJjF rU8.171*-;fߔpU?Lg)8d'U񍍺 Xy;UNA]Ps Sbzט ~T*HD;aVM&tn}ϒlԿya2Ęusk#X|۹~_N&yutg^y,#"< sH[dii&g\IDC[dcTf₣i WND_Sa m Γ M5>#emq6m1WꝌ b: ;<:w"[^N/tl[(.N&HWb/ccgqߑ];3^yB1eiG^ib `HeVӦnȷZp ߃n)h(gFtͥr} Yr߫˪(ZaA.JNXN%ҕyƼ3&6XȐ kHOyc6}{QeMF%-}Id%)9|yb Ăq5E\ڨ ym/,V8kхqtxTvDikv=1b^{ !g`=;pI>4 ]V!`)wgf([ŀJ5|N2bшiG%'y^ O(s2t=+U!?B'C\.[_ 1>qq1ͫ# wmZ ءGʯbKpgC!X%`Ca$mW̞ḘKJriz2m" u:Mx vj󆰪ApkueE5>%3ڤ s`P*nya߹NVod#VOͱkRY>?j7ێvUU($R퀓}(-1e=cHb dϜbIͮ UKAMiiM%WτKö~%HPYgCamBl]@$""e`؎w->^@uH?{peQFIM55PlPiݗ-xV*n]>Lxra{j}EA~ϔܴF,uA"02WiɜU:ʻn07h|#^HZ'!RBSl"nϮWӈ_#Vl"G=Cn )ğv(>m-o99s'"ܲ^fg}eI'962]'‰q͢NA02̔aG'ro xw{CUi}T%kX?Lu+qJR7´B7 O(N:̂lՑigɨD8#OD&@1PT+f^`G69g݋m5H4sʴ[ZPbUr; EfsTZ&TWwhx@X(9qznnVQq(ӔyI"ԯI4'>]?WбOKO12e"6DL))U1(WK>ZU?kKnk@bspEhOQ n`mKYx1?X1-M%o*g4%.|Ixmet;NWB:K-T䧭"/WLL0iG.+D *BӍF\bri1i6MϨvN8/B +”q{?."dCq Bg{LP26TG $/T7c֡2b:KtQ ռ𮚉睈ɟ씛)XgKBP74Ϛ S jw|iebh1FB*rWyBcC҄U6(M`#{5[32.vJ S e.6EL L~?Pbqb2Bb?y>DlbU!v[*7nUțKx"1|1dem8Q?&C`8=Դd4Olճ^" pUqyGYN[ti4zȆLw9.'JyC냵QFAy%N=<.N\d9b7yZ.>N#SKT@H>LZ;%F()J L>ŐO*><z @MJl[Eg0> : O-ϱ#۩& zS?ʰi ) ܀$ N?ʫ M &̱MuL2e%–173?y(ir{g+U驹8ɾY}֞,?eed%c ZU %Lz"ҫWҫR91"_4aGChlMOj$q6 I.Y=qZ̠Ѕ'ExnYĔBj/46v}@ݾd&07)]1ڂ+d"PucVEK2 T6^' q>dgES6 `f\&(r1jA"wFPP]E(Ώxx >W惿R"}ߧa-c"q3:z|!Ԝ83 5Q-$|~U3 X5+M b6069شQaJ_, }nnqe`+''PG_=[maf 5A{ؙ9O\w?}qf ]l:!3HJzef5SE,%~`bI{S,ᢵ"y׭^aѱ ?r=d)7Rat2鄿Ya1YYФC:RŪ+{%<% 1`s"xݓYFǝKMYL`>#Î/0RѢtM"- 4i}mAdO$M\*uX)6$Cc,Xr]gO|Z2A)ľQEox̖MC<6Xlots|rzѷc _gXW<A:zٔAl^@=}8~"yq﷩eՀ[G1+{lqp 諏Oh;D %0$d۴楧l>f;+FdR碋'B.mZ:Ջ6bve |)щsԺ>S.Zg~|W [\Wc8 ձ׸49 u0?_,D('Q]ArdM*B J,\xCMVaF8iL۟ "ڼx} =7s 5. 9;->oQ^TLo K.FW]Vp _HqԦUrc]Ad6DCbJ -cЖ}#}4 XHvُ//G@3ɵ-c u_6ޞ]X+eEI"]]U][-ɺ(' ں7,Lkd׃΍Z rDX:`R>;?ͪRyd9VuX6FB~EJd)9:&rl2iMhQT U"8F|tF>ZެSyP&"dK EoܓcbC̉B`u3R{lq4C=H435'#ID`^9qw-ϿZCf|T٬(%ݍn!luK2xN A 3uCw@^)\C?RA*=ZkR|*iN)|:hٝ.ۼq˜Ν/.p{6plOcγ:=隔!m\PrmmEӆ.G5 #3< (pjZ1hĂ5;YqϫKMflh󭹄-1wPe1j=/+S %qe/r1g Pv@F vK k$}BmOE.i$Wba׿Fs,RJ;:0.*K3NE7>zjl{iIfMfUH YGԣw7V;,/Xd|loCz̜Sgrx>b/z?nBGBBYC~eDZGGNvK. {ݮWV bNUUSxQwevБaְɞ ̰c  P]?\K[ `GU}Q=mWq7{1/.y~S1Im⌡KTR 1:h]s댔ЊQ9ZIۉ]N!}yVa 0[DL`Us) c2Y7 ߎbfR&q,iMp6:Yjwc5uawtbrBAo9%>X'OUOW.h Yo4 щPTqlUUU[7Mf2ep|^@Efrߣcޖ1[aDP1Zd$cmW GOG4CQpM/$}GH~^")vmr杖ItPKX71ޭg>Pݸ"!aW#`E_;(4 ɧ\oru-@'6DJ#oMh;3ʿ :^AoҰ5V\H6>0?f޿Н| O=aNwtկj5DowrěGEPUh< | ykggMvLWص7QJQV'[C ]p4VzME y~trSg ӴAh9Gf3*-K %x[g1V+:@`la,kڰTO~ ^jP:En/?8{Ǣy@F1DX7GoaŔB<#{?[w'Р {IU1Cv{m)@9{D!P8FKA ve/m`E (t[﬩K\7͋}" ͷg.B{ȶ^ >`~d9UɖLDͅ ԕ]lrbعMc߂uMPJ?٩jZC_d>L٪zI7~0{H 3wQ0mufns\*֑"EUcu缳ԁ|)ፙǫg'Kp\b P WdPkḝ53/YK(p?$$?ȧ xۉQfU X }Z(%wTCcsT[8$QI)'>9R5uJvtJt˱?Vqy b}NĄ|A|[ԡ+e'r%+aj eiѾhB8PcbY jK,_-64+QMRX|7Is xy{_2SWlOESTG+#JC& P)8ƎCeF6FЇ!8XɕX"|$w=TH Ǯx,c>͟Sײ:%#Q OR42t]˕L%b{4cYTeXX/j!r'Ky{Pvnso>=)z?JNU@Ăr.7@Ea/A2 PVzC C@NVjb3 Y}}2~5i6#\jQ+*;Qv:ݙڈIpUT j\ZLj9'uGJ}X,"YwYu{PbB4z-P /2U[J`'K ty'&qQQ1^ 𴒕**K7ڰuȁ"싛 "-, ޜ̠ͧ4Bi/n_czƵ<iQ=rNR?nM9zsgZ\m y*?TM0Q+=`4 U/1OTRp w@Κݑ5d tV<WL98TjBtgFaP~*?$5΋i_GϽ Cfj bBv9"vL3bP4Iw$Q\?Wv{(Flp7Me" Kjs"/$]*!WP[D qg^tϐm,&>G% Gs8SKP_,5*t~N~pRDڈ}B=j60ƽJ' 0Ƿw.GYvDeVLמFc-23p(l#?_ի7vz29Ryc׎sD0Oh'\m.5Y#e/R`!L@ ?qODzCʓ $Vf&0Պi_dKy͞z֖b9Xx%U& A4/< C۾ԏ$H$mv .nXФUgZq|6#3t[ +k`\Bb䉡ĩz6_`U} WA%|?Gtjh|mG{\P?|`RLۼe9*s|:9 qCy~HGZ;ΙEE96![im $6EٖsETaVXKW*q$@OT/&k=f -oXX}g0ʥüh; FrZ[=eC7T;0_[!X4/;{v]7Y7d}$ bjFs~o0B8sڶ2ǂS #aJN1|}W@`@h#wU͚/ԥX L2c]U Bų/{ELKSF91b-^(gNXQh3D)Ilf­^Hq{JEo.{0e(ɨќgMnJ l 9EX,-I1ͪ`ŕG;#dO3IdXB6`'Ujȴ4aB7wÄ#! X3A-=D=6ʯ&t-2R/8@:u)4^d9E4RZ85@y^,wzpҧ[CIw#V3Of:F f  U,"OkԂ|Õ#aVXir2>.y]{ ?!SGtwt4Ϫ\\`g9^Fov]GaY'o^nn>EV[zA)6] ^1X<:PڤkvmD|1=R(Lf";Mq V3j ;|+ 㥀{R:OoSۦZ<Ya>*ᏞɢLu1di@-I <|8]n(Zk/:<#djVLS}D5 *?%fd-CXq ] ~ ˿h[)ak  aҵsi?cՏ5= xH7i{C@dr rt+Wj948nX~ V9lP/ FLIhe}v$=w\g, 3 ǽʪeЈx^NS∞cSmDmW H;&-BUa.*M,hD"wJh 79Ȃ`I%xZ^Wխj,$Ixд5aťܗmulie.U %yZY,Lh-K@ ;QIIuup0LPjϗq5Z;^BK QoJT:z BCjk%v^9&'T~ahŧݍB$J^|;s~ JiM8FoS¶RuQ++i;X{IVaHCr>2^p Qд!A۩g]iF=LS?.⿈Fgߩ-ת%|TI8$K txlEi.ga$R34>iJ5V_ubR`hLS+iwdbJQ}Qk$6عhOu*[}1Z=.o, I>PZaYm Z1OV …>T(n+^m\k2F$V7b)iF]yי6}$AthEuYۥ-jjWj}W Ιƈseu!--&;z=z^2QhWM:A1e2oc޴Vܝ 5ΔPG-N\0gBfg|Zg+ CRfjΗerI~u0A;ntΩoN|xVi>< M-;-3$ZŪWyM}5HݪGW$m3X? 'rC->̅\o){1(U?$#әF.1dwnôlw;ڥcZi,Ru4aDpkj}g^ǩ0 w"ɬͻi/N-e $G(94ǟ2VnbGpB@k;% 9?Z,U@/!Kf.z]34zdd $Q~lx[`~ F.I'1 4kHlR\ d}cV:r̰$*Y 6Hz^(_, J%0WІtԐ2R=Pʹk@5''n|AKkjK& 6KKA}w? Gb Z\ub63swZ!+R~39MtZnz˓.վ ̔/VWƂ*` cܑ-KSW ``&@^JARNוw2w$Mӵ"6XJ"]B_>.U3U58IGVa95*jlf$@H` ]h%ȿ6:̌xڏWoW]b˺o&bZo-oVr ߥ7r@Ņ{wTRnU? -+@LbguuONĶc}Kp/݀2u59~V97b҆ʔ#[;TƧԂ݃ՉNE)ybN#kU[m i,HVb$b0;Clq1Srm\S!z.2D=Vg_SyD cM]''B ]},^`fEy5Θo{@9J4˝x#::i-5H^ ܦbRTH@3c1*">tc1&Gh ˲ʜ6[? DZS#[5\Cr֬aHn^9W{ M͆\{SjL ? m;[.&an1'KmOAon6tE'}ks_^Pŧɗ(X2'iv udK ])S6öZS/?^İ0W\:!g:^&`e/2=??=^lA?ٳ,0R 4ϠG77e$>3¬(sZ&PdE* El wNdo2|9 w*;;+i{Ss4Wè$~KC.~CMktGUޡěLKޖO/fړS(tE 6Λ~iB0}$>`G=^Ƚ>+kQ7gߛ/>!շiE. ^RGVS\:Y{m(8LLX`Z:I7{of&T@sekasuSk۞A'RNr^R C&Bc)YQ]Ux]P'~ ebo H^52+xPJ;H%?I2񝍹=ŁWOSRmϨA)osTpX`3Pz{ 5!IM>x60tppGyJ2=/'Rع-okz ,PQߏJ#׍Efy>4JEYٯQr'$e̩QDWY=1\|\H] zLlr;`WžSy#7և}2 PBoءؾ(B.;ImɅ,[ 7Dn̊]6ṋ7w,l/üq#sݍ05%kTDtqt WE_ڨx._1[*<[lMi1L~eH\L X\7-*YK$'\l[fvh)*xgT~3~-XOh'a{4g=iz.;pԮ~4T9FӮ!CCTBP]UuA&s6:ҢNΌXÚ~\7-ι2[כбcsh'Miiq5(@Sn>3,xDKයWOe'p\S:FXCɜa&8/LhT)2sxXǎ:`v Ν`<sXO_` |q ՗gŋ-+p:X0Y `i]ֻO"qSMrmK(]~;9W ׏Jaa,$BHe#:B(z.K^]LU!ր uJAL&%Mmv yy!U^c$K\ׇQ'KUq: #' wX0k7Q(ںCi v" ΋>$~Cv BH }*;^?{", [Q}W4_V'3*GQ1Zh)gg¥BGT|'ӶqBA69V"ΚɼCY^!a[6{pIbF 6eVKg9[q#y_࠭HMKh&(ž(D)/M5[iYv;ļN)J(!]p8.MP5+OM42gNG804_D>H_٬25sLMXן$5ktqD.ٳ@}Gc#DĽUʒI{ 2+nRy/yh\cQ6omsMG1_h3qLìp,F`'4I?b1%F|FκQZZJS3}X&[u.:QQr7YzPQӆ3qF]Okᇲl;򪸬.sfoQB>FID.]PUX9`#Mp{9` 30ה,nn\&zB-vSm(aJ^[Sj 7EmXv(G}Jb~.@Y`T%:o.viyv&YVQ oh>F:)-C%){їm{|L#U_EWQφx8Z;@fpFi* \zNALIBtP gW~J55~ʂRcMY_ яQ&xod{QD۫ I.U{~4m RVOˮj5xײdK]eӿ{y@2eRWU|(љ2P?BPw=Cx=JK$or 0p+>R5] TM"F!|Z-uU-u^ihU[bɐA\wP$sրm՞y>/+@=Hrn^e%msf:p0*yUT(s東-!l+?r fo Tm? 8IOd'JGI60qd$()S5kAB0H~]pV쐁& ӝ Zýsmv4Jh[f3HEq1݇'%V`1XU2Q,9+S-}-mPDu] 尫jaVs 2B.):)xړYAh7d_ 惕/3 1Yw]Y&kQT٢2w["osdAn >λ#6C5|z\Ng̀=֞k 9$ܓaBkL@/P%{C_"|YFշ| ŕ{4b,Zv7#'R_R$%^*N\X3%ijc FsHp)RA݅-dA%1Ƚ:Typ1<)~퓕4^$wI>QSJx ^_넑bzM$z 6{QL&@vK[ ?!"|u'`0xo e嘊tYpREx)<9j̵Jf9t`Dpl5yt*_qDfoal)14o#/|q,DCgf`̽MbD&rKQ<4<"Y@SC;tlMMmdϽof|RNdD~* S&\yѳ2 1w5V1BZZP toS{q_>#JLzs擰%Uw,iiت)<[8`h\SKN~2?}4;FA\tiF,1,o!-њ<x.;!q1J-Y6,St{K8|aKzsV޳^mZsyc:)ĖQeFmX7/ H_>݄>I,$d~*pyMɪlUp*ng1 Bnqiۏ!q@/9Gf=#[ 5J(4X@v%z\*$:FBbE̥y1bja?h&aF/9.~[{8ގG,.LO\M3qҤqq#drwҡV0TH7or J aشe7ʮ;C@ #(exܕڷ.)>n-x0Tu4WV6~¾c-Kusd!L!wK/1!dKEPy#>RP璔 J3G]y^{') ]OD&կǾN+Qe=xFn4b@)wh`{~**CV҇Ƚ#@% */l49@jxĎ {V/4,)u.hϡ-_tՂA\/Q Dkn^Md0;dM;  i!OZ_%)x$C%S`8,\Jl`*1pJ@yWU{oEMl9o0s&(cX3yH'eWi],{,$~i.!%xm~eX&{~oAq'|ECʢJ<냥D]9pWi;^ғkkskA G9A[W[/QyvW'rqjBiы GWBP|YʸSjo @1RGw7׉oqշCL8 !EU&Akjҩ0/cj{e 8CU>TrR^⧅ P<suļv|aJe܊CfV[KKY0(DsQ -C~&I o\3_J()efAl IDO_/B"Fhkxe|9ϘӺ l턋@vI=8%Z0tW#:Wį~?>T.%73I5dgװKeukK';yj t<ڶ?3db3˷{-`rF} H$):NZW.|!^,2-> Ú]K'Ƿ=PLxņ#<Փ#R*-ฎأ[2tf۵}D6/K>4+&2S+ @"^FіR+7JSx^GTǝRAjQ(h&vw.yS_h;2*0gQ?]{2s{oGK" \>^ry{K`e؀Um:^P~YfaHBqh!>㯣LavgF:,wл툋7o}gbƍT[ i\?0Y`J(1ZѝN* nN]g[B+ck`+8BH"l.K*dLR(.C ]R{C&6%~:wenôOYtkj}a_1Ev1 V;)lBkj!nGzd49œonG]B ?!Niˑ}խ\bnE )ږ;}F{sV#?O&Jm5|ϡy Bx/`9eIA6qS˕ޗU<{⊻, zqe_gײPy>_ #1g+tPEAU8Y 0 # B$?ѓ@a/L ~`N )2=bYi }ӽpB\8LHҷ2v-)jN-s&F91˚#jA{;o|!Qd߀orYy)/MM._:xSW(p&j^5[֨E)%}2҄Г>/F^:Pi(9J{s0~G(mD'po;oN/^ 7\HL1-mRP$#zpLAG;aEvNf>z(Q1:@0<%6=+ֆ_К{Ϊ%uˣ]䪋r 'Q.A3j%q"#| ; 8.)e\2X^}J kEmb-$:rrmsNg8O^a6d=%ALZk4 )P{4 Z5)1xRk Tx;VPѯX5M8UsC93-nޠhW[s+FbTDZ`pmdTǝu=sy$ߩ൦l QqD0U#ZԷDe w2RW,H&F~8l\e6T,QEG+k81U84 1aIũG\ M>Z[Aȸ7^yl5ʎ5)i_3*XO&`OmERRʿr҈n^AJ}j(y$EUv xrd` $OC5?/./FuzaW֍"U7$+1(>8{SMq Lg{zf~@"hHS+}t*QHp?a:,k> ǖiVϏ":wE+:8;7ίL1N;(ZeTb0=>D uWh>Yb <6'^o Oy!/_\~`څp^hğBnh o/V>1 ̛Qx~Ă@w᫓L6t@+oŎqvB|d?$ U4 #xZ뷱D]!{:hSg7u5Daxwvv@5hߗޞb!Q3Wx%Sz9q HO~u]Ӛ ʜ߱6]x?x)"U,cN>] J]!h4Y ;c1\B{QtTbc(\X9?$%E|~ED۩\G6cUD=z\ˎT(Lp 83c@ } Br YγeuCt)-Ҏe8[8>7*Svt{`\ͮxA&e)8aQ;ӸbksLgtk n(x,K3W:z.Q.gNjJKwj6@H3cGtF` f"<^HmpnEFXH'1f P1Sz VqljQWms(pB=.ٓ#̌J V#(kh\٠^vZDjiyK`TiA,Rx;Q%b\d3z#լ$ed#aE1 xS#kqdVJnSv1VEٴ?_Pk_d7ϊF`Lt+G.uIzr4=(Ur _S p&AE_Qټ"=-Gp["NcPQV#f~Ig/S=C9`ʴz\Fmũ q`nI2ӡ9Me MXwQ >-"}m.paĠ7"h.q>>ahbk`Dy^ ŞP&߼~KvJ7}ȋU2YMwp4 t*j`"5o3F Igkf?'1Z0%ܐ" )r^y t!M$e&3<$kW>FD 36NVN62?ߝ0p  lyၭr$af-SxH*M19A~ 'p*wRThk?eX۲]h>矼ǃ+Ѻ9zF@uC.yEqSC.M% & S:tu N[mxT(ٽ'OZڒ4 *" ٧Rn3Y( R1Z'M ,`OqVhS:Q fdF=4vB-> fsMG#EIysgr nXRD#ahpeLB< T-&Z"rͥc+>G7=PlqO tߢAl ε\&Fl\juLhVqdR%UT|/fY WiWqk+ كCj"3s^z%"s(2qMܴ^E~t|uڻ*lq<(A|3> q88pwlѝr<[Q|p.oH+JLc|Z"OB˪ 6_b: 1YOQ$k?yy@ i Sw01RF8=;;d }xKǥms52ZĜQBSTѹvz';%vUa3MRl3 ƸG:պKac=}0Q.K&;u)7A |&nI{YS1*-lCkT}&E vN:{]Gm3I#M(fAILuGF|OFkfG h_Jm/&J2ϵQ:2lP~ #7c彌XNcIK[(=“@PyV)#ڬXQ@?( 4s *x9׎A~e$o|N`ژKǡ'UMi=q2<B[^f/vDN>BE?#ކ.JZ" SN0[DvW9*n.Y]~f8U4-79CKeYYB;~49$1ub?〗ս,H Cչa^oZ&?9fvcgmzf$֓+d>}'AbUJA|n."z瞩RS0Hy 42 oh;eYB)G7G =]ۥҗFtLOբ#$+/pp?F\-ilfĉf,^Jw&G2pVt"l/R7rЃ@*v:آI>`vJv/&s7&?AuI8"Ħ~R*pStO4k?QY6P2aG=];mTi7`Gゃ\@G: pϣ[&~G,pӛ13gبdڍ`ѓSA>ƻ8w˶8Vϟ 攮ɛrwV~RM fFJB OSBri#'~8QTMsZsէAӝ=}͚ 5tt89b1e+5NudJW[ݢ^53ׂ>.m!ώd)w#*=?&]2s.1v,A[B_e_3 T e$k{c] [jI.o(3#6&);nU&1N>{S\]%)am=zh~umHƜ%D(DvYnK]=!<({0fr76AyMdrJ̐wޑi^e`2,pߚǐ&>a?vg<B$$ZѶFwi 牻ҘhDDq?Tܪk;mkI@F m}N(Km&M ωV~~Wۨ{`C$enB%O wsZYlDp@>|[.i˕ Y|Fˆ #_9u LꑠfCO$Vݽxrz/^f<U󭺐jg)zx)TXt>f,T2'v- ̫"Li"P (my\'x:cMWG1HŨ4ڟN<)@AQqWF鄋)G*Us q eC9(ݔÎv2+u#qYbU:#%@H߻>&%K -,[JU$F*߁ڋl,k di%28JnSg&O/U`Г&P}1/ߡ-3\{]޾ܪB5 P0 $f\xԗW@3woa>^v,~ͯl}[loЙ|'+5:6;,ϵ}>W'##%~%a@^DY,e/;Wiמ@>_#.J!rnMT|m}/ZZGX<-kܼT |.t>Nz%m8)qx@ #3#,ϫJYp#=0at[Ҍ'`|CYi:AsTpSm3Z.+;;Y|13YlNf[8:$PDD@FrWkDٹ99\~3τ` 5@\[_wٮ{+D$Jjk}7@&?Ia;uڥ-_|hD 1OW1RƚyJ6[6 DIƽ2y^M֤ryR+okWw:B2p,|2=`L:q[4" 'wx `0\"MzFk9pkd$Z{ai@"J}YLu`*.)j_ms8=P-Eg?/0>?rU)+Wfb>R,,C v  96V;]0q uWkRZubE@&zPrhlmĘXwۥd mdJ `5mԝHG4} K+ w "% _M4|a&Zj2>GJء@49>J%(A> R N` 뒪%\qg1L{Ozdwn ^X&~ݔ9mdz =llO+42JcFPq8:PzOA.j]'!I\1njݡ-բM??-!ˆMeh9LRx-)J sU4NT.ͳAYKǚ3'>cq}T!7HF> 9R:p_:7 b1k{2qL3ϚF|&o?u}GȞxëihhGz0+ãom# TmH;M(o>5HQp[WdŦ3CO#|x=+5{LJCni`f+WXixO+Ax}m+1Vf],q5#JR\X /Z=a fr%t8o2cG o]/[~ܽ;GG{=9WNTzxOL9ECPM Bi5{M]I7  cPuu/ <$6yX}ѓR+nZ,=zŐ, $O|\&]fsNG}y#R<m*6WBYf̕F܆":muyz:nD~$/;:o<\晫,V1'Gnx =1bNOs"Мeo@12ހ-RcHE̞2ʪ'B}1p''݊Fq#`AUv]osV1O #k+lƅЎE%HU\CĐ@J+*w_MEx=T[u17畐sE5 dgc$8f~@c3JHG/X a,9\#ðKJv!7z\&CTٴ˴7a[Cs%A<%+b2w^!|p_= Bf7;U?$tD %u]WiSt!+qޗD6SЄIpײD~\@Kw%X&kV|KcߧĖa ? LO>_P,EB0F·{hcS~Up t2X2PѰ#=#ũ]|24( TIO"x˛"+Eqα1İg G,=߭z +Wgi>l jqO^#|`/r#ґYPe 6+D\m;=#O$ˇf?֤Lg^v'i9ﵲ-ch MX-\mrE(L B/;PD YJ~7a:UgHߕ-6=ydM ɵ5BmFjy+cfK,>:|m,R#-afo?vmPI >c=\oZW؈Q?U|tt}ڸvxP_f^}."8baCpbgUl=m-W<Z)0$TV0גccpf(2'iMǚWW-%t)|$` fúl!uTλ_|T4Gh 2j?Y^~t c>3ebQwԩf |tԬѱPyz&HA`6E|>',{y>ڪ&kLwq[7G^=G"~6^M@|3/N)Y%Z-4JzSk+5ֳ'K[nRe 0ӡ<_\ں' ~~SG8~:!]}Q^C.xi98V2S̎nEt1qnxYjI),b\=dI:y(>bGJ벗I4bNouꀊG^w33C) NcPUJ{7P% V؁'gl䔔f|fP#pxPfC)|rN1ƾϮ/9_.% aك,tS2M7?qy]-e.:,}cl23g4o_|H ćiBRtI^Z&TjPr)SlFM?bXD*, r!]"P#Piy$0&(fHd5Bh/XZЀ#2~;W K*,m ~xN#[垿EчN9JdAWʧ$Ջ"jh{F9_Ct\s_ƹlR{_ؤ(F=C0hYI}<5Aphu- H:\&kD:83raYDw3~YKjMg?Ƚ#% )]Jl1t33dɵ{L`l 'K$9<"CVn}b v4|icf%+]WߨhOފ_OPB:؂Iu S*I9ufS6󍦁؇\t.\PU:-6t)QlmYޏ% ׳H):*(H j5m qmhգn=Y-j]od)ɠk8;vIgv8ӑг:+Bl xR@ !Ϲ31&}sv=@,%TUkJ`K}Vpߓ4`L 3P9g[>*:Ӱ_.%n,OzG\ Pi0I%>H;zxԘ7@59,w3g a-mh⤬X Ї "Pd7R~,wMY)nn5ebrڼkœFnşڔD l aB~3ԵZ畕ba(s 6kI5/{G% L:JʡbP!W(} H Y !‰g= ydIiC0memWPANfͰ>q胖듩OсQ+6lW"\u:̆r'Іɔ'V$:o?rVc]-\* c"wt -ZUB)!et\FjwV61É4CI{hEo mʪŰxI B̷4.ijSC¬^Ckj͝E7)=d HzƤTqY7/E`\p6HO4,NXL#t-cuo_$0s,gڻ܈:J Qw8@8d x:)ka!~kepgae_ڐLjǰ7Mz*Z#kB'˼x2c捤_h~] xB 5aDh\_` kX1YU> = @bЯ! (flpܽ-F9<mt CF)Xm"}|WØޱb2 >.bH׸$bD#/c4_MC 憷>N9Hc1@E`̺~ z^hMT\T="YfQ}'&Bd\@'#R0A\L淈ޮ.3ꜺvGxEAǜGG1W]4Zu o$ӈC*oW7 =,֙Hm(v,F>`cS e'=KDt|vw5taT~ZTsB>O=)!i5Xyg @'t#/SREqɳBިzoZd0njN3'wВ_B>x'oj x-ML)~$̐*jrE;Y$My_kpcXRph0&a7J1a\^\XǧM|H<Do@i"zƘ \WG+=p6*4USn2.hɇ8c9r-|ZƛʊuľMD{ o[TФ0֖c:x@?a0i.ϫXm ɇ棹}r 9p}PzԾݣ;ZUkL-h~6ebwڶ`I< jw1>զ&dRyVȒ`̐6|Jt@~u'#GUxվ3*EJ8!8rei"c {ǨY^Wdz~;a5BzHg>@B{ &'˰&Vad6cr{)6wU}]A[ٺY$mzAWЉ(3Xc|-d]p{U땛W>'73|z,4~&g w~ 1B[A 1qװ>urEɽw˷`W;TS 80 i$m[6ʰ`ŋm8!9tBM%xC-!ynښjnL2Cv9Bl"UD5"E'7:è< 0;b5a\*{Ŋ&Q9}G=nq gXcKϴ玆DJPR$~xړiQ$-E$>?FS:2Rq4y-)^"v.!k!1M2zۆY .ޙj1v8jԩ&h+0CÞ?`Ac([Q9t >A"k}O\$Y} U& |n6JA"WRw8;8*Ga.- Bʉ@ C@)~0x) )9SSf#7u4Y|t p F}Cm7:fNege=aE뛜hV@(sk_Dny.x,y ώ܎a*(&/UE[ǸyWG|ij@O0#n, [vb?ҀI}.RZmѨ(&栢] W"e9> 댐Bh-w<̖9%p]C3y ~y`rQ/hRMJv 7f$Zt5(=6e6$Q*.+O؁R6h ح\uS)/_ E|adA:)Æ-aܥ4K[u3#+(,@6ڻ 1$a$HTA#h>gVq1ːɎߊ>oHߥ0ۏ]YC8пXN+`{|!H$Pـ?ʂ5^2x_K! *1-r'̰cb&\`\iC~({agj󡒧;K^ Fl, ,ؚ䋈ed?hu]:kO` " 8ԥת XCfP)n?ZHHi(b5഻ګSiHTr[(W eHwu-L.'gVQSy(L 'ÍR0{n]4L+ˏ!/B6;85;> )o%1Z n?^N;鄞J/E,2{5I=FF8g-^psm8`y{.Lf4(e|C1lj w2.`/T,x_׀K'<\`c*qAz2㨑!fr(8Ðo,*L"`Vnɸl`Vj[qsHr,M˃nV 6 FM 72*~b5nG=g1SsG%s.N*;<4aӸ]pb6 }rTFreAhQ7#|  󦬬a5\=z&?mY?N@?M4|qK$BX"Ҧ9uud{ 'mHZ9H< |6]FF=l(hf !`}/`饓LnӦR@Q= 4" }BGCFyl*H{P?_O;Ux'D~dQ8@]|hXcN$.bjT.CE0x,az"M!'urFǿ{eɱ}R'RWy\e,l?cv]F)\n|Ot`mR+(E D)ġُpZPE ஞ:#OnNE$Mdb=, 6 AJED.'až0V%G 32k>0N-̆p!B10ed'ʵ'0V > ےuՌ BWlĂS;8؃/ M\, :*{@1vE4qz <9Dlv YC ;c?W+R5P$ӘYf|7N/W4P $f#傕& Co6x@p815b=l].ffdU}o3'?{3Hip`#rH^2DYS;"ŔB1R"K!N(+:>n)ƶ'!tpbp!wK9~@m0*l?VqgX*d詣dȽy[ndk4(ƇU߁AJ{ 6SbU آ&.=,Ͼxغo5 2Z+g,J7UY־?nMq7:Ή~mMiݰM̾J=|$ff&4VsЮb+<xN|"2n?'8.e  .NVEBZ0[M`ӵaL0R.^sJh͜Q߲aHF1$GW.p !1a!jfg R %_l}aW*4|_fz~QtA߶ m0܎_ȘH¼ك':ӇACB9m$#2KxnQL: ܞgd>@38{Vс$c$\B#'J2]2U,i5.>&a}$RZ!qcq3_dT%ATS΂1TL8B?=Mqb2x:Ƃgט[ f99w$ёQnao 7xJ+ uJl BRcjХjimxCάP= <}D6acW]{T\l{kH[آcr/p:/$ .ScEU.PʔnӁhC'Fr0\ xh]wrkEr$8ZaNyg~<+J,/ҳ{=vL\qT$骀?QYȻd7'E}Z:C+QdM-cf^B_ \R ͤ1ND9}uP3 Ag0;Vgҙ5歽dmG+~D ^.H(e*WfeS%+CDzN8]_7[ztfЭuHiUUa2 JS bmh;F+ei(~Up'1#SɴgX.EkJ#s4\iLG%j&w h )4Q`^" {ZeHSNf*M}.gL3w*#=L};7//\T+ZON2~wb=NX~i? ' .~\=&6KL$,!6H; {7_ +FYPga +b{9+;aSZ9+j9ȇv!?+ͭ54,;ϩ`U`{>>9%"0|м˜I {FɚO"eXbAW97"ڜC )nQt=$Tmr]+^Bc;3"aPJKOCOju y[~"qWN͞%ACOa?%P8¤t2qpw#LDM{J1̢;&*:uHxV6D-*{,^S:Z:H j")vAaw/]W\uxDšzSTV"QzCz"mEi5)P.]O>odՑ`z\'8ܾzm3+=BW=LQ0Z2Fv'@Xt!_+\$ΡQ9,WҡVge/L5ۍbHlA'2s ;(TV> K 4mV |0ǸXr~S?R e`%\loEV&]7c G/  NEbj]c72lmmDF&%C\WV] ViʇPgty^]*K< ۭo䗟-Yq2vPOEGݛFǤ( ?QG0Ga0P3].&ԱZVk:NFD"1OEzRtGK7:7l(Ӎ{ Ӂ ˍH;Ifj`-]"E[.B %9aݛ~ɇ]'K %"hh)(L"<kҲ`Ə*p.c\NŖl^< 8(YEND?U+6Q\ ^=b5D%1Ǯ(mRɩ2 @l8ќjO?Yud›i~84҆W%.#n]`#d oΌSSUkoi3߉*Gİ dܢW6&2WOƚȍk–ҋ(zx7tQN|~Ŋj`u /~H5H22&4SLEh+vgkY\BK$>^{?DGGr%ZBkSimi)A.CZޛOKZ&rYnb r>Dս}JK#R8W&9NP ڳc¡v&H8Y8]XKjFbd~ͤv <%Ja!v?R4|e{̴Qš⧓&qMF=' _5p1c#M̃ wp{U@qV}~q+=Tg.랧n#y %pϩRƤN- zQIHa(F!nd=#k $¡ ǍxOMdXf 5陴|Y r@<)p7!d(Q/9r`㘦S{W8L]I<:0u[nh-[Ξ >oG`*%(3'畀\<_aNCp9pa7uCm}йfuXq<^4\1N~ճ5Shn)"1lܒij`,hVKR ǾpIIdg1=`tw>}VaH4.<󐴜Rle~To]|5~=n;uP0Dpag{A:It^ӱhS>DʋI~P%LafjE )o}B'P8%y <5Q n_̖̚JR]\kzz<|ߤLr-J#VL f Xsnn"2#*;ү̺D2/B1\ڗV{[ҐSLduV1@fzx߀\yoMHucF]R'!g{r|pIU'd1F%H|zP)&qh?$OtAwAva%G("5 P \Rؑ oSK-FrnnXoi4ÜwagzcF$璸P;?f}b>G(/|?kUḰ AJؾ3" y0 J9#t.DS@^L 9O@_P{f 1߮MS>os/F@zdRGY=g-N%#F~9VȄXhTQH] *sb79f>X_,J =74N!wG$b>4eOIvpNxlF+o1Cɢ_٠dB}:g#\0U.z>.c ]nvU+i{E$qWqwawEV.,B{@*}\07uxl < (1yySV3G(qAc>+ _9Mlwlf{t;Bi-8_N܋pC$,Ù#,{YmM7ڧ27OV3y9̼!8b"}yKt>rvܢIp=:Z$ "8--hJJeĎ˲!U ,E齼PI+4~ry0R Qg$~J:[׍v +e v;Qpۮ* Ǥ ߍkgAE{dPSш!hżV=V q@鴌e9[nqt1>${AD g/f_3i} T^&b"5J_ؒa[YX⮯&e:ͲY\ M M|TgwWct@C<".Xy ➾ &'@Gk{kh0cӓ;y#Ikk:PLg ZN%\¿,. \6gtq㯝TQdڹ؜"̽b@sf`t @dJ`$bDiC!"c\2BJ/TGQWHY#זfEmhyOᇟTW3:ѕ§ct\W3yVOJ~i 4}2Uo1IE`ݚ⨩eF tk΄ZRQ.a MKeW3MEǺqGŮ_RԴnCow GqY͐0QR %YTͱ H>>w9D_dw5R;S ?=Ps|R&=?7EI6Jf?c8^X3#o{~,8~vHwTՐ&" wk۳zT Y $osèTg+fp'aWDIl]>Ӵj2Jա@ZwQx~q2y\vβf4%<?+ƛչ, (Ri:+5S0V.lk!HZ2. i_F/*jԌR>vycQHUFi^=VC6IBr hPK0,/4ěc)M0VF3̌ _1R c5]QGMH ub)U]p3־FĚ sq-yKs+v7@54.i蠰 aCea3|d>>EUHxFG:Qq.Ӌ@oIk&ݗMPF?-P IC@LLɢ> 9M`` <Pz}wiGkL2; >+ _zl`jgyC ]opP`Iث8a@ʌl&HVb[4sYkȬmxH-?5V vHBdsYa'VQ:^*5U .=T x_DD2$ 4E&Vr=?U᭽uAS kt~oY|+K]tjY=U6܁ ,~}nQZpcT|!7SP4wa8+M_'κY"v?("MEB#kr&^#_'pu$Q`99^'&sJoQ7P +wPt4Ov 9-93߆CU(neMMHRl(=I(%>3*r? kYXȦɡYu'+( }Nz+ E`#ifVDq">PDJ+Raڝ#!#I*8KF::8i~V\RT*LV.Px~v)i}VaO%mpcwF4spf,4SdL֛`#nk9ސ,$7XRvp~[PtٯCqXb:%p\eg"ە/ܟ<͐;aPL!r1#E%~5 l=Yդ1IydEarIՃi*UC\SnkŜzFmE-mS@WDD@|a`66C:D&IX=^WKb'CV㆜Ghǃ&S.VVk[J*,:6;n˨0p%m">%;TX#lF18PnƏT߈ 8M,GYO,r;9nuy7˻h\]¹b% iiXi޳PCgݴ8T[a+4pD C_:[-oW#42S >Gs#لt();ӣr!}LWP|EXꗑy*$x]V%A-P<2t<ep hx3b`63CLP|YR@ھU42q\>Ln a8xt8Qfd(28Lij~OR Ta.!ohp2d:`ݓ p;\|t_̓lÀxNkʢJ!%cg`M$ S{l7V/i؈l*qT/)96v2#T^~ǒ ^}i1⮽}ڨpMQ-R,-)Y4?06g9"="H|L>Vo$1ej>Q7 vKZBH$G 4@kgwI*LDnǟI:QXXc9D]VjvUĤ,@k%'#aLd[XT=4! 70Y6pEF|@I$X{LDVK#TS67Zx/غ7=2Eвsy{B{|&=GZ0[#^|~>z e.,Ue޻7TMf9~;iQV@+32zoek_/p7 UA |E'HFam^B #@g|jz=yj>A@A#eRSC'ۧQhbټ %Wi=j 7,Qke( P /urwILNsu˭\O8[T}~V/N&n#V9ɻ '>X^ÀWH>/zN;7gk+sl]ZLMA쓿.{Q #E q!TϨHa'Tr @s/of{8+O+G6fI-:lee?HX#ĹL_?]u#7.CK]x*A笔{ ҳ_؟ߠ7u%1\xx;s;[YdpWC SLޝ"?6.ׂ{D|.R7>Tvo/`d0`NExϝ(QNcGf +$^#m[!`%F2Q*d'? lvrn)A;׭sRX%Vh&D5Y;Mn|Q( Ɠ$.2!EUڌbK(@e|HfzE\k/p4 {h2 [4z ujn2K6RC(j2vaʹ y-}$,y}}|K h LwEI{Ai#%' =69Eg)~ lD!-$_b)C) ט^ayH,`Zx|>͡dB3~ !2;j2+yxd!yn$rE11YaNgeIQH}Q%UHks~7 (fC:%0ax )GL,;H@y~U Y%q@dF _mN _^~kמbc#XL8߇uY"1S9rV9)9%խL;Wpf33JfV;ҶZ!u잴 yP5z%4d]6#6ʓiq#g+GoP4|#Q+Ϊ/J=%rIJ·Omd`+BM'N$7YJ`pKWu,|_F( py!Q*ұ`ӼSyԮT6[hj1Kbⷣ Hҡ k['P '^-Խ$[T(kumUx|F:(cc\7U8֗tbBiAIK+U 7vrH]R)Ʊ|^vݥ7A76 /N✔U-Q j]L 4-Rf 9X)ǬY;&B=ǚơm&PcElRARhAm9 LK"[z]91ց S?d1 28usWouP0tH~ QnP#$1A]}0-D!Y*;L[_fX|9 :FYz$£B3  ?wrZlJb?tZ F2z9[0W]d ~V[1l 3O8 D{LQ%cnS[jaԀA5K𓻻(>pA,Qd؝‡JhL)96" 5.H̹lL䎩48:<ө 7ώ+[bѭwL{:4݉f&HBif#/骟w1\S*Fg(f78 sm@,88A0pX8ӾVgҏn[_ZtZ|q*uciy[+/P.ڽeyw8"?j$1)8%C%\]epHZmeY>b97BpI#vC2GOf"@Y^A.?IP_ᶿf*t$,>atہ*fj1կWhEzI',Z$^v%kMgZR1 oX3ÿ}!!zGFDf9/;.ЏHUs57AAfd\)h)jItO*o .?ܭ? 0Քnyl;&TB?&>#}G׎ 73T7pm<'79n?6=ݯv-ࡶQ o,;p^3i&0Y2y*..Aŧe.όXnSg?IEBkk4aVW\vβϰYLI÷2rspwfad"s]Wx9bql'b-ugvVSg &h|rHt d+Uyi$Qb(jsMAy C.sTw/z:;>Gq$D&dj3 &g) #u$@{ڌbFL.Y+=8X 0mQxChI>gj+UW%4IR/0nDu,%ejZ=7V4@/"Pb. ""o~lFq@U\%f8}]j x EZ/D팘\ixcgd)u@3vbfM!Q vp>GOfgrH/=P#!qu\!%#Faz"M%噢+JS#Z5*S!cA梏{p}x(lXoXe~@!j`>>neu,NcwK3MwwNL‰A&$X$߻3>Z,Ԏv ӕ[k)B+\_?"jK[f#{O(d+{RKt;s?O3;T M7&<6>-ÞwB4pX(/((.[L~)'sAAʄWy.t Vo%Vr`Zՠ+u~@u+6ć3֬+@aTW9֣0Q2Zx_@|+g :!Q+n2{.K9.Bla$d Fn((^SMQ"~DʢZQ YO4@gD Plp_o'~;1 )]y取6Js+]81P)ŁUǴGw}yZcN5Bԁԓ+q‚P]Ga2ιIR ?eݳ|:>ϸWJU7vDF sa>K_"n:c>7@iQHg\E? B~&=1˔a8Ũ }OIY?5Hq+8b"pbۅϰvvHg PPp5 ֡3@ހIT_raG,"cvHw -<_-|iF?!{q2QmŻnbB [Y  g̮A×Ҽ$UuVTrofT*^~<9q &:ۢ9(H@m&:s:yIf706R+h1ۇ/XؽCOLtt\ed5:N r~Ǥiׂ*w} h[Ogu'cyC/{.tU]vuօBdr^9xz?a-~x\]5`d@awiF#riݦ0];ת1r $&הEQ/5&dZm~GKZ9NwpVVC3HڬG Wg7oOe)y%ɇn!}F_%@؎]3e5r|d|d'F_^8^$%o돯\F6$L:R-NAfK/YZCsAzonOhF˰qoOK uKYЙ8Ѓ qDlձ<@{"wKBm L#fTyYޏv$m=͇[Q/;r`N?3k_rs 5j&Fɕ G'NwybBŪA^9p!LtGiy0@/gWWƵ}'#J%i)'BǹdB/a: )SE)O)SkLAؗxυC2cYKunN1ִuø.t |kdŮ6x(.,iWOِI:\&><5%opƊ}djo5EB5m'>g3#g*j ^}3Y@gp`F~&} >GŨoɂK@c$m:TCp{,g4%qKeZAX+^}擞c#[1:HW*cfIa/ rKϰܿn,aER!^ŢfJ5xdy)~oXX}bu) Vt1VTg?w㦺 xh 7-1ܝRO0Ԕ_KaܻIdA/56>T$DPXj_tKu\9+X1 OH8IpↃaP2 y@g |U* ǣt 610Wf!…M{ۦTa'>f?M,{w [[#LFy@LF^s!9~zPL aܞ]p.dLiAb%bC8{1`r$0uuz}/ Ox0I ]t 5֥dbUЖ E`MwHf $ce+Ւ5]Q 'a@c@>`J4|v5b5e߸tP<e";[MBm7=GK^ZT|cƭcw]Px 2݋7YuRX-fy{ k.jjY?ulV dx+UR/ ҦE pMHU8h?0 iPRy$3")y2)ȍE0IJu5<܁)"HHD b%4\jKMɘrMSICV>CWUvYeq[mRW;"n4=_d2e+ɗr-݆1:d]5?w(k g -.;=lQܻ-GW'.||KX6RԷ? 'ҏm."C7#wQqT0IS0kO@ɦaP/Qf 8 W(||JaI;`8{mٍܑ4r~H$v@ٶuF{2M`Z-rOw8љ~#&JCgQ8ΘM*.X!xr<LLLQm4 ۈA-,W13]i)WypmX ҍ&K1Z:-hL*4" 0eڝNP+H2P`A')jr&΢SC* r-v t|C]b9¡?XkrZEj ͒ ,3F }J[h3 z s?єz[;  vMC\VZSP׿w^`='ndj-oSg7i[P[]LIDHp^'k/BX^@.9߂Uu3 C 0Qoϟ+qH.ZQVI&oldM7̻$>\ryW=*8q?8#+w!Xi5f&h5&*:<J+ Ü0Jt %9ntʚjwP$ brlNMM'oD$\̚WEA rnC1/VPFqQn g& Mt= jSaS6R! 4ᗫ*sDڸGH;m/A" r֭6^I~ٷog(4 oW 5<' ph⋇lc\ZTeD\$Qh*IzG" yuC81YZVyTzj(U )P-u[,4.<{z/;\ހ,cQ~b!vH8_.밯B+o/qdrv %*Сhjz\$(`6}z<|jE=w 7\kn#agb:Q2e.^%E 5)P9vfVq;H&=*k~[q5ܤ@C djD `g8a@pVUr@L6ex}ަF~H0J]}ɾ̽\FC"EE6h3qUm'!/.}4^Itpy)cR<;jص<:fpmQd7HfK[2>KQeUx=jO^BkKK^ux`_\C]v]!)$%! t0!3!}рl)WoXWFqgJT2萎N :ec|0Z?tn0B\^7 pvS=HwﱩY?|ME)CKW%͡Ve~2V]ϱ\_ԥiUm`x4ѸSz+%%;q&m5 Q*^y`ѕz ^@:??@❾>E2[ec<|ZuR y4\ףCbW1X0gz 6Q&LnT{ .V 7M0m-}ױk;Ni)le~,-n aYoع#j1i}$uȻ,צZ)E[/%3~ ki=[Tƃ0g }wJ|2o1.˂FY6; OZmkq^1$EV[Q vI{ǽ'Q,8R4k΂|yx|ݟ>/"eEfQ0ʫЁJR2ioQ%2\"rZ vw{K#*~/,rM0hjؙ^]/56a M3u3)}$u]qx$ŞɎg5?Ѹ՗wahX8M'J22像rFk"y?!k>?yGT\4mHw z H[~ &c{RֵZgn C}]nْᏇd̂pFi!C5LTw{I?yNPe)iךok EEt/,~^9_!q|$\5Ph"G哎8LjDpȕ aeUx{m Q@,xͺjaf$&0w1Ҟ*P9vRk`%> twJk .< ns:eйxe[+9<.lW ~!+PXOfd-ɜS!#Z1Ȟ% w^(9d#}jrCDA&w.OMFz[->P9:*¾p7Xn(mq4o83ЩRE-y@z~s'ᡩ=+Y=o:{jc):[4nrOn/}ypG>tMbUT?D NlR5t,Mq\QyޙohXs<oXm.`&yz&Yّ:V ln+L!g#b%o{ zb ||:j P6gRNS }B* ~+)>x`$k'^3AؿdvFD}x}|gtz| "Vulub |XI*wX"Fьjslv+juňmK݃qD=]CX薿cU䋛RUҡam4JxMg.٬AJ6;P➊Sq+2? :ipQl8UaTں̣.7TpK*B3 0ŷ7*|T1{_O"mp.#/ IcQǢ:ۑBb:VG)9Iv6Agԧvu$gZh<Jd0a>h!oD1_-( hLv57y'[mu g2E]P7ܡ>5P6դ>2AzT&` jM#GJC$^7=9=p29p\G+se+Dbe7\`5I^ I[ßjƵD(,^ VN1\Dw~yI}&! ?K8G;>W9nٓF<x:b|.ÁmR]@oM%kϰ/XBݻ]Gb6i.*4P2tQW$05U%`C>\z"qW,;oP0w"Ly4exPӉ:YN/n[GfdK}v+o0ev^R)8@b,Ulk\ڽ$cBivZ޻,T094Ϩ[O*RF~,ߘN+mYNi68^cV^ꥯ.ٲ<Ȕsp֚H*8i~䐯SJ1q"0.hfqgUrύn_-aSĖÉιbpB|;ejt@UV| TN DBz F~M4<)=,LĶZD.i6B< 9>QA^~rj2a(8 Sz7 w:}yId&"M@ 0wHkDZ:"/è%zb*:m,io&"&Vy7(+U=$A.Z^hJfA &BWUD)*#S2^zO c]M.dk+VOM_ : i& mtI]y3 n52w[d⁎+vϒjb ƛ.xfeBG5p(2si ̈́ZHFX.TΗ(k2DvsNDž.e&b3>us K0u8һ !͊^j[ G o͉ Y;Z4.bΉFP)}~ѭF\k`qr9ỵ5,)ڇiJ/(Ov |)q_ǮnֵɛUv|MtsBH's=c)@ w_'j dI ?P A(-=Em>ZpW]g7H$BwM!oJ0||eR>XsM26|@7w&+MX7nJ78Ա;]wX'HRϗ툢WףVGS{;un2pnt/uv5դe-az̨o`3W! eMG:,- fjmvYetC Ǎ})p_WiK^Q;<Fr"HJZ߭8Bat /^{-Ůkze70 evErrx%:Nhk!gr6UζD$;.B$2X;y{2Ccz[C aK]·UA:s>zV7>{A"2BKY< ##y|Ai0yp+j l^D%W#_A OЁ7:Ěmڰ`PU(δl򻗵o݄;I* 6fJ CyTbOGŘ*Q9e>JD1a  *u K|7fQ4%#ٲ+0AԴ52펞|3ףOl:ێ>\y),8{RTνrSC@M_NᯧwgW܉ 3l`-oQ* v*Y[G9L9L?* U˚d<}%6giP\n'=/kL%onJ9 kh ;=SY .JrX{.xؽ=5K`g28JF̓+ `|8@+_9+ xn)Z4`uaw܌K&_ nB񘰠uT ֘-n/r",c⭛!q &,o%L2Y%!O2U0}-+'y`QYg~Bl EܑXFjSIBRB @hqĒ7-E(r5KWj EԑNyq鈊sî'uca˽@u";r#CD%|P}מ-'z(xIk{)W pKX5܉/&"0Sujm$ ̪ H~¾WCnzS?f{ S_?\:{.6;=ޢA@~( d0D EyLMtQ9IKo8(Az1;41f詻T"$@w|\zOoH<5фQ1>\S~IK7d.o:dODo!A+Zᕲ)}Z@[S IkOP;)yD潸NaSgaV]ZSY71`FG]~,h`z}sνy&Gas9qaSJlg| 4OFZ?ծNHwA5TiG 8kr2LxbmRD +ڻp m$ ^ӧX‚K7_O8Lg X4#{$Q,sӨFk1BܕORl][BCABRl4ʕLbU69{ F5Ou3T+[AgXsVf(?D.?7 G?_YL=!6>憞|X(])UԽsv PyQ؂ C̝ћ6(((^Nޖ}VBDُZ.uRv+_Z8g ݐcGJEA"[9 К92yPV.-.6h ~yry#(U3ܭrC!¹}PЫeܡ)ː2q83d,ƐUN~HA:~𲝠N ~ N%Y} d|Lr"ɒX1]&rPR(c;hv,FyC5圔V["ƱLr ˥Bac /ro~E)WVu `7yT2sŕSF+װyK$An!熼:|,qSL(̼s\*GU(Vr. ^%ݞ+-yA/qGy0tqKH&db!%yӌ@26 VbDt/zt{@c=S3;r[-5'^~9fCmp˝B2-uQ94I;uhHD @Cٻe/4x2p2š\'j>EZ-I,;mqxԖtVUX`)h@"guC4Ϛ99&IϾ^rϔB݇,&X]. $7ʣ.E}*L&cY¨H@} J(vZS Om8(\:W϶Δ@G:łAjJE˴$ < 򛂯LiמS,cӌIr~K,-ˆ~!"LȖ€A }TqiL4|im`lP'=4)28fɓl(ΩEPB~8N\NjuXWps(5CEr +ǖ뾂$6!|b˒)Ks+3mB@) 10M`Lbx,RhjDW1{ pEeӨux` &dFnB]kg3C N+067F`u|OSb&9࡙&hɥq*LJn%i&ٳzrN4ךrP<*"JE Ï^!$ 42羰0:fNW(s6b(ϕZ[:Ljܜ8o/1zՒz܀FcEr#9YSn-eeH)m4]\=}bffǶlCvfr'_GY|-m*K@QAή$&)]:ǫI0FjYI~ 9H]h\eJG\g$=y݉t ^`%Α9.FP ~zJʢEiWo;^aM8"a.e2+jqTg @ o4޸6lx=ޜt*ܴk֡}t 6l4uǑR\Tz,;"{8&NX5ʜm 4!E HI@8fo @ݖ2(TMg?~]r%}&l@s& 0 QYH5u60VֻQC 9LkJD[-7O>I58lp:ıх :H4 3+xf!;oo.mh PK;So2@X`;4vTD3WgG'_sZ7qRbﰄϤUP&M)},beG-^c~\p:@&OC$=.0ReP~IeW$t;ߘ`/jm>cPM RZrNsz%X#1Ay> tE<(TE}Hg/gbHc'$ĭ&`pRB.p<=aps%]4u-gYKNZ"a |@E lbgѢsakF^oB^^_&v{l8(p-{Tًs~ʬe5_%}Ƒ|sOsY O>ݓ`N",`|- @kʆg _%$+nO|K;qHhO{%xb %YOS/Xn3?Ⱥ).]fWgIyXtvRUIE?n HрQ]J Js w^<(jM|.!._Bfڰ/1p7!A~$ߔ"ˏԤivw}eUW] "J8"^"VZ\6]3&NOhm6;N6cb~ Q[@ۃvm-m5+}ẎP~dST~2~{Ej΍ ,N4Ƚ}NSTzE?DYGNvz&pF}*O(mG5kj1֛4P)R{~%鈖i2v_(]fdnGWJMBVo$eL/NA K>}}[Xf 5 YZ