wpa_supplicant-gui-2.10-150600.7.3.1<>,if5p9|mP,]^ ZI1|xB;@dŢړnґznGF,ٟX*'GFeNۋPhq(2Re F+Ɗe䙭q=ց/9\UJ8 k}kfNDr.590 +}vyd ziOaЖ?gKhVm{泣t=pq3 w_[g3b&@&|$?JFܿnL^dXd7/OUw>>P?@d ' J , BNkq|      *4`h$(Q8X*9*: `*FtGHIXY\]^bcd7e<f?lAuTv\wxyz<Cwpa_supplicant-gui2.10150600.7.3.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.f5nebbiolo SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxppc64le 큤f2f-c803418d422eea51dcf98d1ed3cf0d41cff29e9bd4176302852c37ad4da0914fd57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.3.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(ppc-64)@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3e}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)nebbiolo 17267464212.10-150600.7.3.12.10-150600.7.3.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:35766/SUSE_SLE-15-SP6_Update/1481ab215a0b1830ea80ceb6538f4766-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5ppc64le-suse-linuxELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=481d95dc57295ce48a56a715aaed20f22e921c98, for GNU/Linux 3.10.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)R RRR RRRRR RRRRR R RԼ?Vutf-89a4d0b5e947a44ecdc5b226dbc599bd6d9b7d62a44eb0a64ebdd2577080d0c0b? 7zXZ !t/1Z]"k%}RUJzx+P]8\mH 1}%s+ހG=PP>Kl34uY5;,'b֥]0`Q~ saȁhc dͺ󓂧0dĊϻsnoY?G=t岜9hHN6vl~!N3UfPBH$2׷vHχ_FIo>J<)(-GM]Uh Ej+, v²gt<9 Ԟ wOTZ _ <Q_3I|.{GcTH꘨L .,iD\2F/uş Sh&:, Ɛsr[Xge%X7ʔ#nww"cQ6: B %I.`R {Oݸ?' Moέ;Λed=MTۅp4KУ/ud[|1[tleZƛX۝;omйwc˒(%WT؀8nv_qN,$BkBNFsX)'n f042:e[Y ~)K^+s:M]6:*x>߫0B1ka4vG6!yӖ-l$(%p qbZAMT$Dϗq \=ݕ*SC!8!]K*lFLFHe'A8nQg/FΡSN/5t]I;qjLFџUYB ]u4Q^BDZ %aACcKHazVrEͅu :1Lx Scَ"jC2/l }`4_vJY1?:OЌ=Pda i$(,Q.З0')CJV և^`M&iDS!,< '7Ӭ>NB~3lZ:[e''P ]v Mt˯'i5 }OCIum/AjWe|ڪ~8/v6I:tх!d԰Fe8 #MiB Y9UerޞO=‹3qhPY w">n.H.< .!0/TL@#uVY;S,mtx=ԡs?]bEwJ|8xs:mX1XcnU~-oÁӝJZ1+5,9ȲƣZ2_}c3= #z*g;HϿ,QaMͳLNM45?< $ w-πD($ぽ+ü#ȱTy͏t^LճQ:_d`IBB3H V '?Nñ>o5emZq͋;MM"' $'\Ne-UݽbȈq-˕s7R<볎[(pR|{H~9Ŕ-G UWy&Y\9#Px* hdT2H \Z{HMû[9@ѨQa!r3.X ;wveX-aFB/NJ}|^Y@m.1 yy6g_ΦP( g呵#NE%|;K?Ckm=cpV`~$&g6q5T οh]tALCB!c/30 !.P/8!έ{-̻R?CPUWmc ,)8D@LZXuKwuc6B؛KB($i`ǬD*uVO! _ f2~n[x~, 1j{ޅ"2҂7~6 %<ŘU8Il ,w[3T ]pn l֗<| ~ie||?rk6 Q^IӜ R-Yzz28J٥%{6ҝPmeTbK#ѸsnZ^'ZQfn-S' i[s!X ]HDXnn]ryd$[6GNp9썛81RSfP8j7,"@Pn{"}+ZrA%Esc  ,[&q3^C&3#LџW< Lx$5O8{u4~~PDܐ\ō6 LOEȱCwjHa/AIUNG.7Xz!/}|J!Кp=U]"g${;nsYX1| lx-Uf]Jf(NíL8Eo lzCs< fvqG,* "6{Hpo*0޲@Q1jo?b+AݝR`W%dn}d-qL,S-sv3{!RC8$0IPuwx5ܲNѿ=80"RIsԾu;m6ŻX2L:&-&Y1& 1)`t"d,5{-~4e8SfŴ Z6\ X0XBXD0> ^Zp1|zx101a-]p~ּ 9Lm|_R_?7fwa' \njΗۮ/?5/to9 Eb(Ŵ^B]OSMEۮw11d.mrƋsncaWb9,LQ6GHzZy=&qWK.Rkrw) H6 0V)z1bKff(:*cy!Z%sAte*L4 (Zd.Ƒ%@)yvzM2mlLd8.5t傇²ɚBkF)4mUj2K@ ZtiXDY9q`ǤFgYH"ubMg|Յ\C]s|$v)tл$TPr0{{fC'?!mBLE*%R^ϩ7qms"͎^hxV5-@F s+KTڭ@=1 Vu&\a02uٝE 8Yn~&nׅ[jwjք=OV1όbnݬZ0=NPY ;҆$\gWС"x!Ny#>k3c#}W:^ZzX}8=f/jQLmK|Tgbn~FT%YaP?:` lQ_GVe(ЃK' 7TQo\xwv8]ָIK.ڎz1&i9X d'zfB>i'4ڳ@ <[cӭpqޏy)Ȇ1l)pַM*^A57bkWT4?Unv>?#s'!]”E2œNVB/'AU_FX ŵcaݖi/@9Usǯ4dW}')ВB*,*Y)U[=|nW!yD '\lU&0!Ab/3NDCCpIocnѬyxHcEBu?1NrSQYC* -1۷dֱrD$tnd*#ovqOdV;h&EN ,t}!X7k=W湚 ,f#i[^uD]^^]-\#{Wqz,zC D99bG{bSB5T(QWc`'ˌp?pޚ@| r3~MgZW@LPYaH[9jfkٿ+l4g_ɟN12т+G W_vt4c^RIdRGy'|VhN6"q! !-ڵ(1p jvŚvE#~G=4(KP nV吅.o;YҔoH9JΈZJ/l2D'yĪ >Juu9]aCJKt%a4a%tnY:TPujZ^Y0܍K2F-r߃DX-#fYqUi]s|Z]1A!?V;ݸmT- #A_]|; TEgpRti=fD94ʱ0tM-iEٗJ~-PȆ hH#7=LoQW ,~t{aZ蝡ZfAViُf<8Iyo#GEW?aF,w8.7&/:ebOU bw@z7j,y =_6v@C 6_ p.$E֓/w]IG!ϫrYyv"okJ$Uq,I"\ֻ5v>$\ ;aUEJJѝ?Sjă]ԡ mDr,O-?u*O;(M8M˶v?B+ tQmlv? 2ho5N/# ekFMm.) Q?…G $ȕyfc5 LV%je< 1d')R:R%i{W57vK@B:hl"T`i0pj3A+ƦGMT?Mng;^ ΃p ` Ў\ؤOhfneW@+bnVȚlA,OeHtbvY\NҘeo4ϯ1df2*DC& &O㿹ltT\X{XsM% 8KC0?,m "aރݩG7V>ܙ`NjׅAbX!KʔΌ|]˭dl}\h A( >7n)9| ce"V֎IڙoRgC' u ?qZPޭ!/:2.GeJ1hl?+#ϗMSb/П6'.A c醰k4SZ[ӗėB*ReQљAwgmW,d|hB20w>QtF;/)`}\|yG~1~CCB臉"I툊p H>  KeQ-%+U!;ݤг+ *`3 &rdHG T q1&cϩ%LUÐI(n7f[9 )۔睆u.ږ k< ktyܢq*2z|KJcl[R7 ̴=< A0PTRFaNsWuoST fN )wbv/o6ټ[3ٶME؆g߲eF>$QZNn_zKK& 0KSFOj,rnnrpMl=v\3:/Nq=-V1^qfZZzE#@Wr|="]GүԥH[Dt]l_/6j^IMbbfL,} ;D˓dQql' 0D\JHTASS<T;}Q::̆vwPneX !C񊯙6 @X_A#9lqN0y+DbN;cXZ7 <{Z;itoܣȘ jm `i>ۘxv?sx]fee`\XvkMsmQRs(s,y%87By}͊d _'\_νƙTۨ// / CۿmǸ PqJ^*L]:]0fLN'$48̑k,T_F5.·S(}ݻ3oIhL#;~H. (7Oάxg4Ua12'R'jejc2a߯4p9X1:\B#Uq牆. 36@o,9F:p8/Cݙu҅-{kz!xތ" H ᛎwJUARB@tOz EYw]^;Xk𰛋h܄N[2)K>s6,]ؗBp]S OE)⌝|m5@[8/[bA_NU[3 !D ݒ&8`@[j?%Wo :g?xYBLI_l Z6۲W#*ff&mERv8@Gnf^wK&(XP˃k_@) ^^f*ɷ2F*uB)t{%?`viR!cT)|k~eܢ:XHj u[-cKaH悭>`bGȺRG&,bFVg?1QqCu3 ?&@uA'Tig u' vo82= ݏ> )PnW&?-^55p734M`#0sy(w5$<7)KE(XDgtHgeٵ@؃ob(o wѓj^?΅Ʌ<3`$g&B5LX#\Z& G4<A]Z`DTz䁻oħtrүoWկZ %\y_㻄H1п#Z|&%'O Hc<GUUmy*p$@C|67Ԗy50Ώ6w@b&6K3)>\ AvaO@)!=Evo]Sj'zCg 5*o+hHz+tlkf++*u*s<{˿!bց&hql- uc;&B Zu'Ăԙ%1ͽ"oǬD M7ఎȍ-, v5oMvLCOhqZ2`.DEm\""-DBjbk ~NZE hñM[:Xpo5М0ӓ>Q{~"/#4_2ō5 T6T5<3 _~-ȅH>| DNj3pZi!#oC1hHs ~SU, kA쐎-dE09>u4'؄T헭 SJo@Dq([><3p&?DƤЫBR pVDO#wSURJS=8t /NQd^ S`{Q09Ł`~/utpwG<ũsl6^;^_߃ oə;Z"كXo0}]?z+g6'l%W=@檘 ;c3ۑoמT~_)XiW&\5X'rGΨ M]p9n>[%[Cpګm:+ ~n7('=`Jl$d^3{rf\NV/L'-uENpmYa-˄On)U&1-I@~|;_8s6J=>дA3=@S+sYVXk*93\Rd(ta \ov)x5-ݢWdr~bMJ!E\J0#K]ͅdrIƙzLT`NO łʷN9Sx5\;1v=e\1bn KwiS>a v&`Y2O؝ZHN/4eIyFn=P%aA/eY"2ąƀ~#ysҐJGK-~o^^=7.1C-glG\e"hI0!B4nz]>_X9ZCN;h&C__Ry"Y5Z_T I"SQ}n{nkMq (L$7ɼec݈tqEkk`r/0''pV Kթq{IFń=ɥwBPYmo$e5|!Y~w?˵iFAD4mțvڍsCw 4 7:ѠMCl2v`z' r$`ɾSp)~K| f ݍ%)c: գ2tv>ڶmؤG([j"H'M9}z J -zerѶnV75ek>@8^ d>϶͏ VKoRY&_d.M(ls:԰XVXc'#XG_# ubssn)sgW'yO)mez˵E|sX(ѱ?M:i s mlj)3Pkj23n #~ m?W67F߹m ^b ^жd' W%z tՌngzoԆja-GyC Kyž(?Q8%Ӧ)*M F쏂Z3DA[=U/o1kXϕ zIPySdt cD\ .^Dǹ݂{{<*?}&_0򴐡L!5eS1k&9۪Sm.(PfdEƼ{ٍkw0ഓg|oRG^@@'X,(NK*[p(7h_Gx %mKhS91{ $աt3cgTŁ\WGL3U'cZǧ˓A9O8N7B.ܥbCߚѸOCۀέy1 j}3f6fFp:fipA M9HM_塩˥EjIcG`2)25=hcOL aݐ֪Ve"ϖ-͵;@-xS}E'ŕY1ׁԍP;;ԲeFy9M 0kr3dFh˵|4\a Z`j$NDM9ɒjw^%85]*S₵ǧmmG4Jf4ogŅixRQ)PV0vSV6}4-ZAMzH.Ur不BUn&`ftLܤ%lc?v`͂.l8᭙&GGު#MYGK(gScDZ뮠0Cf%.܈(2ee ^9iى?(bAVo;MV3Y"[ly_ROUnb By7귾8>Jp*:,F&QD"$NGWj̹z~M6Vkf(ő(:|ognsb FuR¶'>uNT4:{Jm&'~鵺+T 6+2͍&i:ٽ!oʄ/F:OaIMR+Y.h4O  r| ϓ{r*,Fڸ4'Z&~3vw&YM̉t'9 eGJ $S_w?:m-m2Ҟo.LLS ^U"Ƙ4I(#QGC;ջz] QɮHpG䲄XR"(66n@hݑZq ^%d6QJYp'JQ); Q$S|K uOBו!RTu%:%j?J]aok+@$4^A"El威8 КN)kT>g $)҃(t!bl1uZA*KBd/#C"PWҘC.1+;$k3uܩ>܂J$Dq>p!4*hFP3)dY?No;aID,;_#?f0*揞RR#j06E{eU((!CЪ[fBFmFOHCiC_avi[4[0dቔIuRw\R{ Ka`c3lgEm̗W騿dɣp"T]IFJjJlve ?uX:jo.MFp tI?9iujR9*$ `g8S*H̴pyu%RҷmGz(]sEȠv\5½7&s؁M[Ac~Z''uyyGqX@}ίܘu⚷]D½N?gs߆\3x*.Y7Uh׃?P7+owҺΐ10W+C1w+H;q;$PvtK콾mrZTA?ڔSG)gm}mc?$g΁Vb&a˥GI?Ew 1|Ƴ_)dGcD50ԁ=5IU:/Rϟ‰_c9}4?;=W&95i55-TT踺mJ^ j~Vuu9U瞆t 1,nĘL `UpA#Yq*iZCAp6A ̆@gNp>m0w"X7KQ*tC- $Q'JO߄@s0d!j Ir~ׇ*fҒT${K.͏S(dy W~ yAd.+l*d8{%E 1y߬HYac;Wyܚ0{ޏHһ`C^#+/|2N&DPEo& اةK;;2&3_]/zdIC$4(4;_ j 3-3}1G:w-u!)1h@:'J@tL9AR&g,V`WA&'h^Z-w8P=Zd?Mf2 HxlU~ay|s.6W³Pk6٩P5 I]@\=wiUC@igT(OdKOʘ$5" _{g 1a` jax2z,?$}ވa WjCfY4v|/3K<y`YH^#vˆO*Z0(7Q`DjfGI};c-pB|H1I۵@~"4A/$#qt(635WQtmݑT-킉mu9ש%%lӢkʹb 3sۅV}?'fL<~ިG-n,Jpf zcwE*]9G/}0dG!k"iOJxR?:-SҦbM(M):qw vtUӲ NO54>(%vѸ2#yuT9:q^cf(MNwyAY4¼>!UH&1ߕqA 6xn RX*UٺijIFU0sw;`Ǜt`wfs~rpAĽ@2D<.ٹ`?r/w jn-3"1F6_ dQSZEUp~MR^E>eWÊvk֊!6';H^$|#ψL#I$嶌qٴ5/x7킹 gᵲFܖ懀f!I{^ ܈V\"’}a@Q>ߞHl]o&Pp-n)(0eb|21I-EE&H3)<@L7NKb Rm::' W[vMO7x9MdxQEytŲmLjİ͂ΗS-AAH4QOx1wT2`TꙘTB"X %XH~h Dn{U_ՀvGFe7bdB[~?P1u>DP}>/cyw܆ Qp[t Ob{X5O8  N]u4/}ۊ r#y ʹu4C̢|:։᥂%j|YrUZ>e$}TNɧ |'9~]TȀ pW}nI}أ˿eDʫm/qE}m_\B@/k pH:nhѐ>T4HP?h ;Ÿ!zC/tzbuS[k*,)XS7IYiMsfl"x57σ.L0l`b%㣆a";n5ϵ|v?,82t: dq>@ad1FE7X}{7%` AλN%+g1 IhoVV,1xhS0u s=gEe ąE]`c-U(7ԫybِ[cի :J$?Vo4T5{bwd; XkĈ ̗piMC52 rImfKac!w[$ -!!VfLP m~h@sԟd<%yX_eAS2Q vRbDq4*P`'J`ş=s6(?*Mo}qP%W:DMb|ǥQqU$Ov~U'mĽd&jW0%Kua[tuWs^b2IB)W;eǔ%No=s(1GMݦ+|F,#`^{a-9̧=-Ȥ_kObj;װK1|rmYo[ۿ*y.NfV^tADwMx䅵Hs|Nlq"h5N\FgE)p-@# kK3WdrfYT:2k{>ݚ[*3ԃGU7wI--Å@kS}#r=ɋj9Pq/cF#208YHi@,T[ZH 'w85YlF% n٠=r[%l"!'PTUitM?W%0lL-0<ق/~khHUK̴ +Z, #!RhLsDZitbW=y@:#:N_6T5z+A%4ǹ򛺑 hZa^d}ҘƟVhOOM- FcNqyOd|lk!Hy!yRWyh&?Sئ\sQ5'*(9˴9)2ɰb>ŽIh8ƥ)S-nRcH2}.ɇIGlQA }Ć8467gԮļ3/_U1{G%V7"RV*@h_^/(tNLJZy Xh08R7/N/#V,5g{ s*/QIh oPZi9Icc'?pV4m t/I,E0~AfcvOVt +M4KckxHزi9g(zD0kByy-=z&,'L6tj85,>c.iwҟp9A1;`=9G,{]5E}@j:vO0'{6R.` ;QEߕk{1ҸȜ/zڝӞN͖n y++\t}@(&9л{C'LIR`~K,Rc(1s {ir~+)5!LLL3l Wk.ԟ'JO֞0))++~U{} zi#l4V?{IiEMYΑpI՘y.x~Ȳu>u'+_mt="5PE~ 1i/ބzY ZbB|pV(`4F!: qnAF %t_=p_/: CKU`Rp{$̒O(cV@j6|%tUPAĎbG%BB$TmnMg˃G ƒ)EdV!x? ]dnB@j`\y~'Ef{-Z{ =sTbs:v;d'WRך[="TR'}=t.ܒE]#J{9Ãj$n-Aƫ-'|p|JG)9IY:'c0޺8gl؁͉`r )tQN4\_R6B[s5 =yU|1 +xдEc3~SdV]>JAYL4oXn"gNwч3 X{8į` vv[dѪ bס mr2Fmp<_5Q.Y5uXhkxX`C\wx4gh:=xFzY 8ȓhT_B{MQkn+"e2dx_,KfH3 %滻]$ú/}OMTO)qs?a>fK+jOLEm!=q)9B$ANBdP>r[ѱNYLEqOHNtbo9MrD +Χ0 pGJ|D8ltZv45-n`MֻWVQݒlARhޚ_Žύ-"8|elnܞː>;σ.5\ :".wzlz5Ѽ$*PitG@>Ewy$k;S-@*nB wаu*c>%Mlύ"ߛ\`obL^rqNu~lj(OP@H?/cľہ졀}xSTYɬּ"SJtWWYzIώa7@6ɣ^!Oaz(p'4|9lHVD՗A\0.P#lvDESTHQx ֐xx^J}ъJ%q/8UMQA:R9BΊ6YOܙ2Qm8"Ѻ!8A>P auW5[Eݬ"wn%&: zDMS^cz{d2*qvt%N 9 fʛM;̋_RP7/tIYaˇ ãj;.dL$%OiuQ*k3qB.u6ӈ@8|NMV,:L (i0JEak*DRXMiky"eySw\`fZq9cJaE9]^ 1RսMLBW  DUn1 DոRәs)e6e3*1g$@)j i7L}W4i`G4\,'X&]u[un56b3v'鳮+4d:[GܖT}B)7!2XI&mLO0f(3'VU!5DSyTPc3#tjB8a.5۪;a?~˶XrPՍ(ĻtCIU1~! H,.>xRTXÄTn#-a i=?7Q@&vy%fͻCnqZPȘp"!`.. 2K6E&/b3yǐbSZIEimOg # g/4 r]J<1Ǵ{R{;ctO2HDp\w^ HQ#qjmbXmCTC&e6KpCqeOo-w&:(}s1(&Ks1\]At꒕=l.TDsfNfLԜ͂D/WI؝nlBjLDxYw$^2A*:^{6n E3j`CU0~D:[#h_Ƨ;X;Hd,,{7~\T*ͭvhH §_:[;|41}WRv{ќě慃c C:j g$uOd<&wc'D36M̶ƴ_šr=wmBI #da=,>48n.iNblq4{VD(W+lʝӟ bd'.pV(Ng+AsMMVwOΣ,3:s46`MF1QB/R-& `Ҝ4,Q61f`. fOӻ_/%q4`xm2Vt%yM];]n~ՄFhHR{Cԗ)s 1;L3e;a-_F?'|h)WuSPIfUNè•PH Mj@vfY ؑܜJ4P)b(aZbc}+>WJr{(kZ 3^ 612q~'H9zq1SۯB)EҐr&tUX A^W k7k{ytSGr"m+郔 ? a(q/./Dʅ 'TR'KGi(<%qGln *FCaϷrg$5! \EL 3)ɳ@-)~P,XQRމSd}_ְCմQ;왕_-Th(-hepkI5 \IDQj { o9rWmQ W_N.Ya_ɞ{']7sUڱNZlZI*ۘJT1)k SN;ǁ /1LhϲKHm/OƗ}{6lޢ=nKaFfpׅ줛[$UAFh4Mbpڱ={ 4죶& MQQoT w乤A*\H(Vm3/pEY)YF5]?ކⷤIcGsGۼe K:# !,/=amw?73 Srg%AiM0 gdN}ȶ%z_ Y=2 '$ϧ?26{pj`ػYᱢ~ޞK,5=2K!w,kkUvT'A/]$Ř*2rday2cDnm

kPL= jt*0=tYIK H/u5>J{b jxJE$.}B5I]uZ2a֍B+|Z3E * ƓO(S1$GpY1hDeJ r7 :]2čI g?<&'ZL.h ׃A3zC XCv 3ZNx| g0JҘs dБ~$jw~[V_ 2\(KT3/Ab`]֒+ K;>^kA=/+kMdWN;-CSrv~.͡:VP@Ў??xXX‘Hy ݢm /!19glN@rQ :HC^G:W) u2*V#Τ贈c}DF[ _#Bل r O㔺b"< {? h8,;_$U`IigM;xHIP0-@C:2[@favOOO?4Z?KjrE[+jf `r>Zua+0m Dc—:ٓEc=5L`HƞԠ4Y#Yv!uq"wS-TCsxp%C!m6];}q{TGybB@w]ZZ)@t>%8qalCah@*~REܗrֺ亨6`ܨ @}fo2  cJ; jq!\q/E*=/Z\)te&J{j=]z+  d/ʭ. #/*'NcrB Lj׬w{AD@UDmYĨ dEJjyGg%&ثOVt3=`MzްC3bQͅwӄ*排CM܅Q'gT%9uM/]}ޣF}9l{U7tw-E |j4f8Lv&Hg> ,<lt ḩ7~w7%cǓ*fl!0^>>Hs?$u JS"3gQBkcql"?ܔB`ki:a9Y0RyrǾzHwTa q\Nb &ND ʼn/`Jakj ={LBRrc!݂F%o ,җi}+=NAaV\(h7nPq¯:AZ`7iNO_] AAM9'5$!C'zw-3\ɧ.6]8ώ:32ЫYK04஻&+]?+H).)L(ަ\`rf'ʳdE;!;qZa 'z""#c>IV;N%"5R ЩjL틶ow^-pZ3`_.6#ȟqq㊇] sX,BX\HςLjOhbbFެz C3t LSWxvi$.'nBÜxQ$UXE iZ#G֓X9Mા=СލThghFVDKqQ'Sժo=Fgl_I~Q- ?'l 7 uqyvVd,;,!:`TRήҩ=5f6UWuעG@Ԋj9{ɚ*MOYc=\ $^>;ϠTa~TZLT,~EC`}8Rotk= j4hdpoi)F|m&m/1W+3K%^6tI`R+= 93戅Pq H7Xᐌ4(ܧ~4+6pufª22ۘ5A]׆`֖"N]!Ҁ k++w6/Ń :vR`1G&%H=nE"z}[#a̎gjLk@i(DkHS[HRB$@A,fÈ)h3#F\j(KL#_Jg"+GϞ @7.&o[.d> XqlgjyJEG3҈JmWf3T5mJ ^ *9i8Vw^ ɢ#nbyVu8@厭J:S} ϤZZ0|LR&=kzY6Saڭb2F&@BgulRpE6{D~W8Fme@_C=YNw5vJ- G&Y-ߛwJ;ih_l- Ǒ=Wa-{2'/;Vb2R5W@bx>16pɀvO4P]`])yy!uӎvtrRȷ ֠l;&6˧h"@!P'^V=^}RB)6Dd.}<9Fה![fikJ?pVH_%.)Ֆĥ&*쌩V;!e9>bHBin 7l%—PFYry2=DR$hNr!^5(ΆC7m ,39;s/YdRLθT%{⳯'X0Ix&A(^r]vK;<'7} TiUHkm{\V6QZ,E)5*Dzz#&G,J;!}nmvfd~`#ց9/2ﶘW8E{\^hh)5@vXNj$/!@}i+3*.bqsEfǁeixWղ@%R74361ȪhE0cC_ .den/L@ֶ&?R-y¡S1ut>lMf.{xʖ-x+= Qƣ[<躲F;8:c3y(6û ]H!~}(] ׌ۚ%q X% 2U?ܛ-po t)Z;~pݒ]}Sg[} L~<1["c/lq}8'= 4 nr."ĴwнOojQE}243z;p1`DďW '6]ة5}Iچ{Lub]wJ^@nhu~+šեW 5\_ y? ]psvCh:7-3kGc9X".uBf1&Î>ZDVR^~9㢲YSAe|ncK3 &ɡ.0|) !'FiejWCDBQ[& $g8UzΕmjV=Hlh|nL}v[NڤI.n֞):Jx,6W]gvM0s-0Wi"jd~Y7Gt`7 ^_aJ[@a4jc^pnsd}Y\T|{u"c^u͜Vw} L`R%hi.7-;W't00du2ؚ/69sVXȹZe.k!ѻ!ԱEXXZCcuyPN+X1ab? 쓼“$>[ C7{"z&u\Jv?J&cz]e-^FɋEtf ; b/¤| 4 Śrw@dYl҉Bc09*`{J*"e}1-Hoo # GӘ [b\ynȧh@P^ŠpR)c>[HV*qbD M]{miJ%>9_4SCYT^:|mi~W\1J|ۚI:K!v̰BKI%=SP#ThI9 t$]M^F@x̶Х6H]Y/9T=*gh’dR2X:9ٻ@G=SJPI4A߂q2O@ zv9U(4~icm>#O0TZS/GlQҙ+sI1"cICJTӟNDʕu+lR5Av#Xb^plFl|=:ȅɖEO4 ;ٰ憒dih ؆l;ؠ?Y=7 '+CG;5Pii @aV p-.H#ޑw$ן%y`Lr=gW[*2 rlsF_P 6,WvZhV3^+|̌IqKPY\f 1:pZ9un3)Ϥ,ߞ¶QQ;^z]u[+|wcL֚aĿCл ۫k=]̷!F@;E^)bvKѴ6,&(! j[{L ^&-|?_M+nxCjHukȦHw0Bsv$`d`UR[@rwoAM9:f˼̆9rӶwK@?, $<sűkWI <#s%-KʈM̀_czQM8J+pnjCcK}KSJA{kŐ3*gy̶m@їK:t278WYemha&otn^iO\UAR%C#c P ɯIMe]6Jg^B 6q̠3iꆆb[aViߚ_Mw뾻W|ޙqU6]׼agND(3o[L.N6crbjSMs!FPRxb N7?/D>Sc&ژG|iQߌGm&;d$yoWR!եpx70=/jG8!371Yt~KTυ:c:D+ЃIׇRMF#2|Z#eHkRƢi:X('Ӛb!\ٿPT,Ʋ#-lKiǴŜD߃<[-zcuKi4QP B›$<8`D.mߑNz q9s/:$RfuVaq1 HY;O4 a?'=۝5XVF\j9j]ɨmډ‡$a#`:rv: 5:tYz׿9LK` CT<J2I ۑD' w^ES88b |8ݤR;~XemB=v X;7dVnI]YIoSNL&!Wusnl9-4e: pU j.җJx B޴^K‘Xi!CRKԮé%`Nf?t%>Y)K5@  &PUw-]y6zL|4c1>,Aq!<ф#U"eBvNII?" Jʚ\Ė L= &ܫ-|KNhFgd 3Xu4ÇD5QɃ%[qRXPDQB<2wGgYUH,A3~SVhw۹T롎&WMWN8X!80f{9V*E1a/'r/${|W\܂nJ0F+| uۀ\E]eΡ93h2 ?{(8fv_JѷW/姁rsN"oNEqtI',o$jq?@,Ķ*Oʻ ̐A7p˻ḗV\ُE)x6`67^ aԑ2/^-CőGwBe:@ 2VO%STA*4P-#aG]!/T=(HO Nn zҁ9Lv}'ճvmUȀP^3T<&ajH^Tgl7QFL$0.-Su~+=4 1Č#Y񕲒.D3)¿\ ]QNI(䴷SX旯ZZۉH A,bf$˚Rq' SA7 \Z*Vga o djq$ȹLXfJc2̷2t"t*3)ca@5!z#"՗KZ*k\ABğcXHs `S)495,!I1!Lu0z:V+MGU a4 2Wd3= |?"7bw8&kd~I|7˕BOUOg`P-7l+/66OK?h5c˗aaͲPX<Ў4ƯJrqְs+. `_TCV-i.G~YHm{i󟋺Ɯ(ϳ9r:]hS++"'X>f=Tmm\яHz]^W[9OCHek0e[]ѧ {M;Ll_ڰ< Õa1%v 1g+Q zN FgD*Oʖ*+[k>CO5S*o4u ~mY(wX,߸S?Gx MA om])tgXI7f1@|s DZʖz0m&o~EL wZQ8ʊTSM3|60ڛ+@>0g}s8O2E^SʙsG/=tCyY| Na ;mɤ`#FN0pnDO%;BBJ ECH`~n>03l(ϟz޳w^G:)e_k%Q$]iﯲH@Wy0]x&?Ů%́E'7 .CQE+2~gU8:#i,b"QR3#V5]lU$P5!+~l)]6tH hY~9D+=7ppo/(~I83BHǹձ dtM:ٺoŐnϷhF9AtXFF 3XTl@9kK5BHZS4xG_^^/]Fm1[%i' >n35>e1 `+Z!h<=7po.?D$` u߹)^y@eߴCl/ _ޫe\oJcsSIs j=Kt>[@OhWϴ:,^ )oɟL0k2 e8%Z'k#3+Jtb-՚[()"E',fJ'zEkwo:̒Ce$X+V(psPj@d4Aஂ4aQy-^$:wB>#-DoZV7(_֘h '<Č!:.q!!B cMe5^UX|܎g0pC5 `E A4a5ea Ly{D:jRqGPhVi{q/ 8夷w*@eso w5: GH BmHRelt*QXIS]W=6'Saw}kԸvO9Ju fA"hI0xR|n(v\ݣLsJՖFoǥ@R`TlxTw9sw9cִV8O$xDG7c]Rk IqVqgt8|txՉ1WN_F+yI¡dM ˗bԸbqUrg2s>/~in23Agea& Ǎ۵@<0{ Ƹ*m5:i?)F5U/pو '0ϧq'd% S./R$': ,HV؈Y,jg=l01ఐwFb=oy@hgNS7 1qb{WM 6%\y?ݮ~0Hh.9c 蟧Ʉ}dnq2!(Jǘb= .<},n ЄY'{˲ P$PF4+u?yaAM+̔x<80_YAحɩcPo\#05+ZB;4l=#t7q%@8cdBrڮz]|O/)]v|ŇR:YQ8f(*{8tzJ><1>78q?t;Ƿ罞D0/%vUQ}b⍗Y]E\T f`6XcBj JT&867ED9r|HXd+QHSɊikWir\kzJp~o !(2~ˆ_=cZBJ/P,rKH%=ՃiwC9y1[,PuR]mUw#2ymw}yw?J \2űN慜@{1D29h}@_ $%&WDi8:na?&*_Mׅ؍#!Z{0=_ o9IKf&i;boZ4v@,N-|\Iz_(Kti័i OHޒKq,!`}?(@dnawkjdؗ*1a)YS= 2"4[ޏAYy* 9m4:Ky \8^-Bܐ|knz]2]OdY$bk7dFD9^ (?F$i@ˈP`5% f:P}R&iLP @6n/uaz+[0HXkM;c"fUAԎAve/rxN]x &?H WV;U:ӝt{)\j`'*e Ɠsl&-;o& ?wUK?,z[F4v'*3X%o"{0z)g/]=>jCٚ=o--OD~"rUZR!ش J;hs:nSP,PUP⓴vͭ*Suc2~dK]T6k(qe(`ejhV-d!!YGd 1‡ښ9?OFHGZ3wm2lۣ粆`3@7߰s0{^S'&y*w.C_D\.7N4TJ? FxHoZ<6O1R[ tTbZ(G#ZT>אث#3_ޘߜ*WgjxO tqU%Pm a!ƻnνEٛp_D[ufS?g" 죏dA hŀOv|RTۘ3_ZGVO%}Z1oVZ&O&]U_:doߛ|uI|wǏr;-DO.¦b- p 5)㤿i>B_S_;γ[)_q&DWhJGR7g(%|)ݞ%Q F[1fN )Ҡ:zT)b;G~xvtv*U6xuC>ş6c 8~ޞc:Çx N pi !i]1ɊQ%)|>%(e<.Cyj3KR+ Ѷ5JH^%)>uۏ DZ68$ Hֺrֻi`ՇTRPźc+RpeNʚ#$9nc/%PۇBFqF+>8V=[[VP`TP& ҏp,ryb n gP'vmDtUJM Sb!xB?F]^xd?Yk3\)9hT]Z 2j 5{WwfI%K ߬Snek*J*8_!?Ȼ5#3p<Ǒ/AשOktS_tc&D.鶚Y>/BL/ YNdJeئVLȹA(K?HfOe5f2c~Q} Cb%u`BhY$,g0xK#V_ rCHri/lN}b #ZG1:S?3Ca-4x(X4dz^-] hzSujC^WYC߹d}Fli6d5KM~x)SoDקּc$41JNbve~7bP(qq_"{m|2L涓N dvJ&F/ "ԘK%dӢ.:);qV| õ+~esn>s1 ݦAKP:Ya1b8ZRIsvU JP*w-0#K3L\10WkK`O|#L3aܞ sIһͤ_Q 5}u&~ fQ(l9+U("?<g7 h'+h٘k;q%6k*@Rִ%nXi[._8%`}ԁͬнre{ թ>{lߪ:cb9|}@d#NiPXJ߹vC "9(JFC_:9tei/{aF#\a~?J 1m z2pxK~Cva1X{% YFPkar]%U+\ ~,wuF2At-mWgv~#_djjmRn60*HۀsjNƥDj3šj$l⩨s/0g6B ,(ЌXؠS>9,~ÌܨчYCiC &2mѡ}|]EǨV? ~] >dVPwuƼb=>'d׷ҥVX눪(  ,#2p}yxwlI6~.$I=T4dR0;`#?8(~Sy hvc %*zY,0b(}*߷Z%ȴ8 0~=!nq_=wLv)̔lXר#x+f!j!mA PazZ_sC~ %L+-픭]m;tA wCM"JOI~z 9y;gx`'!Mˀ$Ps7Y/%ڎ*YE8*xhGos!o`i{ge6k{j>=ؽ^K29k급f;7X(@gIM0v4NU)@XU^0rY[3^`Nō)6 dGI et,IeL3S8Ӂn0-5XB 8 iv|cdC 8Oeg:s .޷b?DΉbkuL\{&GJ!Rc5 rx.dAoeOOuՊ`U#s`FdU4&oJg9Ls4;x(H$H HtO<)3`(=U$KGhOQ9{z)X1ouY?_A嵚6'0`L[K9w_`kO}OAnq!`rEϋN(Z>nG1R)QJ}8!Z =0M[졟J!KaE|,,d_  E!YwA3|B?2[ic遢X{7b@<^՜{01(t'4?­c4AVu$^^*WgOdP(\0*ݗ-+viSƯJ)1ї gj?CkQwUN7ׂ vAZ"2/H;mQC3)pqԼdI 5-ޱ/GrJXNu!MsSȯ }2!SGZuF$x1 Qw6k.h>>^%4DҶƋZ64_~'i9fzޜq M´1upZ5=>݀7 qRm\]IqUOeNÃ-.5w^a_k?OGkZxύ'?U`237GLWߦwb5hR2eHҘkn/T S!4 kr~ۭ׾VZϐ`f&=#f~@bםz(46rY9UDuoP>P 5x<7CP}ЂD|*aPtW5=e}MQ4,tw<|&?%Yuo%ǏfZS:8<퉸 p).UĔn53 , +Ï˽9T$^鶺'çnWΐVpɞ%sv@6#ܲ+|o7UXf蜊Y!xS|̐UІ.YHw^g[ӺsAGqm([3~mQ>2]砽(q¼}qRҚޣ,ֈO虓\OK&\wE[:\i)i*xENӮ:D6rZQtDt.SHtw7E2 k¢% dWϞ&7>ʼnv%̋uTCҬgzGd e2 <'ZPNmGtw}ݲ1a7RuR4[U>a~մJd^=gvs;jГx`«sN.Zg~Fl-!aVGӸX$=E ɍe]aZ9`> 8LaϻphmFIpd,:M%‰#٢14x+P{,zI{ j痰aOEe!ZwzcznŵҚXI_Z]waQ\x둢{0(Wo"7(u*/'FMbL%ͭgq5}uԝ9d)^kVIG$3cmw.zA{\kr,U3ZW]^!6FJFo4z(4*qȂV>J7:QKI+B9 Xo<^==nCExzB{g5]'[*=z?P)4I{_ .[Tq٥|}G,;Gj<`6E?= 9y#\[].ʭ1c0[EیuR%43D\j&,N^Kq ٺteKnwNi۽S(,dof z_}BEARvU$p~W]~GEC !9s%ldFs4tw`EsWM ?Zh'*a, b݂esK2 Ot(8TyL4@-K9c}- !..`inGu0 1Q+*lj,6>nJ|o"k@N#LaN7(ś; W ̤4Qيm[[`łދ%|NU*!8tPDL:k|+%K(aTNxo]HKD!_PYVUirܬ,$78 h ƒ8ȵﻌ8}Ktom]ԭUKz[;`^2 L*7́0cdJ }~#\~@鰌0^ |CMOFOۇCjo"Rt`2jOU7" Q;\2+t]%韣᪔@+)2gɵxAP"D0lRƼ:`;-%R&nt7kmR e% g; '.%kɹZu{)tb?aadٍs_|XZh|pzerqQJ{)3kA[NңGMx*&5˸6R#|_T14)(L/~x_%#UL94.rk\Bn].\o2? VQ-o1WTB~KvfI(2"1[ij-ޜ)hY04t`xr]s}rDAUl=ވ~Q^J|IIDeMp;`LJ QWfV2Kւa(WNvZ"=Z![hhxܸ=jwtɢ'x,5kƆYXjIdm!@kVSMbHNg"i]:1;5+q>̥ |Sek{O 2e,mֹPC$[3e8}#gJU.9Kk,3G' F}JmGϜt.9>c ስAobJ:W F6~9(g=ʍCtљ^#\ɄQ\JFk\ $~F>i,PDy/'[=)Q믡`ݪƂt ?lJU T>|`[zhnħ?bk=-tYfQL=TN2R hQ+] h;ded# 4@GPm',J7V11*lqT4^&[.=mK@3u9rc 5!]O dtHp=o'EJ@K8j4D iQLz(GYS2BhZ;M,>10m ѳhYP!\Y`Jާ,3bjR+}NNF'9ˡ 7*äҘ 4WiL(d Զ3!ʢ"tЮ,׆-In<1\a71RQ>(&.~/o"i; S 6S־U}={)rkqtR&qi'W4W?wㄾl k 2cCT--4}){fU>CYZO-NrdoLp:v\ՕF q#^;$%ak<|nDДs(J#/Xwh'1mn[37u58@+ I$ P ĬO)'ק5=Aj[_ 26دD`>ȒӜBr(a{jP~N{[N:4E7242i@܂.cfBje(/A]'8J::~DK$L`gܤ5/뫪U C&axQC2uLQJG(Ƀd~H9}d30H7}Ctu'o}d+PoFn]I ;87N#j+6* j^3*^DBo6^X/R-(P/M>n@vGO|SEoMScz|8Yt,GNõ zΤ) WyjöuAYKʀ5_jV3գ4So,װ+47"b4rږ[ Eϙͮᗑ5k> ZA! ]~Q6DRnjGPa #!Iz+t~1S{c]#U0DJ/0!,dlgv駷my |b:YvW+?v]/7$kCǔk9-\E-۪=^5Wsc}ї?:xga?hl+"&.y: YZ