shim-15.4-lp152.4.17.1<>,`` w/=„ diT$Ϩ8&a!z[$g5w~dh[-YSx ڻsl {1b JvثJB-Ȕ'׮蔧RdƋSM] "r7&ƞ-k{m0j:e&ޘ1<*}hMgp*Bx&'j3~*V™YcW3QekO*:bh>@O?Od   * X   0  b$8 \  (8$G9 @G:G>HGIHIPIIXIYI\I]J ^J bKcLDdLeLfLlLuLvM8wMxMyNNO'O0O4O:O|Cshim15.4lp152.4.17.1UEFI shim loadershim is a trivial EFI application that, when run, attempts to open and execute another application.` wcloud117openSUSE Leap 15.2openSUSEBSD-2-Clausehttp://bugs.opensuse.orgSystem/Boothttps://github.com/rhboot/shimlinuxx86_64 loader_type=`sed -n \ "/^[^#]*LOADER_TYPE=/{s@.*=\(.*\)@\1@;s@^[\"']@@;s@[\"']\\$@@;p;q}" \ /etc/sysconfig/bootloader \ 2>/dev/null || :` for bl in grub2-efi; do if test "x${bl}" == "x$loader_type"; then mkdir -p /run/update-bootloader/ touch /run/update-bootloader/reinit break fi donex%#((6 Px@AA큤AA큤AA큤$` )` )` )` )` )` )` )` )` )` *`c'` )` )` v` v` )` v` (207c5da802269733f7e69bfb38dddc35dc139747dc751dc9bb04c69d5befbb7dd128174d340bf46f4bd9351b2df5875bad2904ad1112f08f3f7ba6248b4da47515edf527919ddcb2f514ab9d16ad07ef219e4bb490e0b79560be510f0c159cc2337039e16c7e002a9c6149123e84bcf0514666560999cb1e28c4f063f24bb519c0f66755b341b52ca17d216b5c5a8fd2cb7e8527147030a6e72fc385e736150c207c5da802269733f7e69bfb38dddc35dc139747dc751dc9bb04c69d5befbb7d5acea78ea3b73d67039e6feb1e0465e7291b999066f3fbe923f58c58e78d1ea7../../share/efi/x86_64/MokManager.efi../../share/efi/x86_64/fallback.efi../../share/efi/x86_64/shim-opensuse.efi../../share/efi/x86_64/shim-opensuse.efishim-opensuse.efirootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootrootshim-15.4-lp152.4.17.1.src.rpmshimshim(x86-64)@      /bin/bash/bin/sh/bin/shgrub2-x86_64-efiperl-Bootloaderrpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)3.0.4-14.6.0-14.0-15.2-14.14.1`#@`ݮ@`@`O@`+``n@`m`dd@`a@`[)_C_$_*@_X@_X@^0^@^oj@]e@]V\@\r@\}\,@\eX@\N\@n@\Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Johannes Segitz Gary Ching-Pang Lin Johannes Segitz Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Johannes Segitz Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin Michael Chang Gary Ching-Pang Lin Martin Liška Gary Ching-Pang Lin Gary Ching-Pang Lin jsegitz@suse.comrw@suse.comGary Ching-Pang Lin rw@suse.comGary Ching-Pang Lin Gary Ching-Pang Lin Gary Ching-Pang Lin glin@suse.comglin@suse.comglin@suse.comglin@suse.comglin@suse.comglin@suse.comglin@suse.comngompa13@gmail.comglin@suse.comglin@suse.comglin@suse.comglin@suse.combwiedemann@suse.comglin@suse.comglin@suse.commchang@suse.commchang@suse.comglin@suse.commchang@suse.commchang@suse.comglin@suse.comglin@suse.comglin@suse.comglin@suse.comrw@suse.comagraf@suse.commchang@suse.comjsegitz@novell.comglin@suse.comjsegitz@novell.commchang@suse.comglin@suse.comglin@suse.comglin@suse.comglin@suse.comcrrodriguez@opensuse.orgmchang@suse.comglin@suse.comglin@suse.comjsegitz@novell.com- Updated openSUSE x86 signature- Add shim-bsc1187696-avoid-deleting-rt-variables.patch to avoid deleting the mirrored RT variables (bsc#1187696)- Split the keys in vendor-dbx.bin to vendor-dbx-sles and vendor-dbx-opensuse for shim-sles and shim-opensuse to reduce the size of MokListXRT (bsc#1185261) + Also update generate-vendor-dbx.sh in dbx-cert.tar.xz - Add shim-bsc1185441-fix-handling-of-ignore_db-and-user_insecure_mode.patch to handle ignore_db and user_insecure_mode correctly (bsc#1185441, bsc#1187071) - Add shim-bsc1185621-relax-max-var-sz-check.patch to relax the maximum variable size check for u-boot (bsc#1185621) + Also drop AArch64 suse-signed shim since we merged this patch - Add shim-bsc1185261-relax-import_mok_state-check.patch to relax the check for import_mok_state() when Secure Boot is off. (bsc#1185261) - Add shim-bsc1185232-relax-loadoptions-length-check.patch to ignore the odd LoadOptions length (bsc#1185232) - shim-install: reset def_shim_efi to "shim.efi" if the given file doesn't exist - Add shim-fix-aa64-relsz.patch to fix the size of rela sections for AArch64 Fix: https://github.com/rhboot/shim/issues/371 - Add shim-disable-export-vendor-dbx.patch to disable exporting vendor-dbx to MokListXRT since writing a large RT variable could crash some machines (bsc#1185261) - Add shim-bsc1187260-fix-efi-1.10-machines.patch to avoid the potential crash when calling QueryVariableInfo in EFI 1.10 machines (bsc#1187260) - Add shim-bsc1185232-fix-config-table-copying.patch to avoid buffer overflow when copying data to the MOK config table (bsc#1185232)- shim-install: instead of assuming "removable" for Azure, remove fallback.efi from \EFI\Boot and copy grub.efi/cfg to \EFI\Boot to make \EFI\Boot bootable and keep the boot option created by efibootmgr (bsc#1185464, bsc#1185961)- shim-install: always assume "removable" for Azure to avoid the endless reset loop (bsc#1185464)- Updated openSUSE x86 signature- Add shim-bsc1184454-allocate-mok-config-table-BS.patch to avoid the error message during linux system boot (bsc#1184454)- Add remove_build_id.patch to prevent the build id being added to the binary. That can cause issues with the signature- Update to 15.4 (bsc#1182057) + Rename the SBAT variable and fix the self-check of SBAT + sbat: add more dprint() + arm/aa64: Swizzle some sections to make old sbsign happier + arm/aa64 targets: put .rel* and .dyn* in .rodata - Drop upstreamed patch: shim-bsc1182057-sbat-variable-enhancement.patch- Add shim-bsc1182057-sbat-variable-enhancement.patch to change the SBAT variable name and enhance the handling of SBAT (bsc#1182057)- Update to 15.3 for SBAT support (bsc#1182057) + Drop gnu-efi from BuildRequires since upstream pull it into the + Include the fixes for bsc#1175509, bsc#1173411, bsc#1177404, bsc#1175509, bsc#1174512 - Generate vender-specific SBAT metadata + Add dos2unix to BuildRequires since Makefile requires it for vendor SBAT - Update dbx-cert.tar.xz and vendor-dbx.bin to block the following sign keys: + SLES-UEFI-SIGN-Certificate-2020-07.crt + openSUSE-UEFI-SIGN-Certificate-2020-07.crt - Refresh patches + shim-arch-independent-names.patch + shim-change-debug-file-path.patch - Add shim-bsc1177315-verify-eku-codesign.patch to check CodeSign in the signer's EKU (bsc#1177315) - Add shim-bsc1177789-fix-null-pointer-deref-AuthenticodeVerify.patch to fix NULL pointer dereference in AuthenticodeVerify() (bsc#1177789, CVE-2019-14584) - Drop upstreamed fixes + shim-always-mirror-mok-variables.patch + gcc9-fix-warnings.patch + shim-fix-gnu-efi-3.0.11.patch + shim-bsc1092000-fallback-menu.patch + shim-bsc1173411-only-check-efi-var-on-sb.patch + shim-correct-license-in-headers.patch - Drop shim-opensuse-cert-prompt.patch + All newly released openSUSE kernels enable kernel lockdown and signature verification, so there is no need to add the prompt anymore. - Amend timestamp.pl to include the linker version to avoid the potential breakage of signature due to the upgrade of binutils + Also update the signature files to add the linker version - shim-install: Support changing default shim efi binary in /usr/etc/default/shim and /etc/default/shim (bsc#1177315)- shim-install: install MokManager to \EFI\boot to process the pending MOK request (bsc#1175626, bsc#1175656)- Updated openSUSE signature- Update the path to grub-tpm.efi in shim-install (bsc#1174320)- Use vendor-dbx to block old SUSE/openSUSE signkeys (bsc#1168994) + Add dbx-cert.tar.xz which contains the certificates to block and a script, generate-vendor-dbx.sh, to generate vendor-dbx.bin + Add vendor-dbx.bin as the vendor dbx to block unwanted keys - Drop shim-opensuse-signed.efi + We don't need it anymore- Add shim-bsc1173411-only-check-efi-var-on-sb.patch to only check EFI variable copying when Secure Boot is enabled (bsc#1173411)- Use the full path of efibootmgr to avoid errors when invoking shim-install from packagekitd (bsc#1168104)- Use "suse_version" instead of "sle_version" to avoid shim_lib64_share_compat being set in Tumbleweed forever.- Add shim-fix-gnu-efi-3.0.11.patch to fix the build error caused by the upgrade of gnu-efi- shim-install: add check for btrfs is used as root file system to enable relative path lookup for file. (bsc#1153953)- Fix a typo in shim-install (bsc#1145802)- Add gcc9-fix-warnings.patch (bsc#1121268).- Add shim-opensuse-signed.efi, the openSUSE shim-15+git47 binary (bsc#1113225)- Disable AArch64 build (FATE#325971) + AArch64 machines don't use UEFI CA, at least for now.- Updated shim signature: signature-sles.x86_64.asc (bsc#1120026)- Fix conditions for '/usr/share/efi'-move (FATE#326960)- Amend shim.spec to remove $RPM_BUILD_ROOT- Move 'efi'-executables to '/usr/share/efi' (FATE#326960) (preparing the move to 'noarch' for this package)- Update shim-install to handle the partitioned MD devices (bsc#1119762, bsc#1119763)- Update to 15+git47 (bsc#1120026, FATE#325971) + git commit: b3e4d1f7555aabbf5d54de5ea7cd7e839e7bd83d - Retire the old openSUSE 4096 bit certificate + Those programs are already out of maintenance. - Add shim-always-mirror-mok-variables.patch to mirror MOK variables correctly - Add shim-correct-license-in-headers.patch to correct the license declaration - Refresh patches: + shim-arch-independent-names.patch + shim-change-debug-file-path.patch + shim-bsc1092000-fallback-menu.patch + shim-opensuse-cert-prompt.patch - Drop upstreamed patches: + shim-bsc1088585-handle-mok-allocations-better.patch + shim-httpboot-amend-device-path.patch + shim-httpboot-include-console.h.patch + shim-only-os-name.patch + shim-remove-cryptpem.patch- Update shim-install to specify the target for grub2-install and change the boot efi file name according to the architecture (bsc#1118363, FATE#325971)- Enable AArch64 build (FATE#325971) + Also add the aarch64 signature files and rename the x86_64 signature files- Add shim-bsc1092000-fallback-menu.patch to show a menu before system reset ((bsc#1092000))- Add shim-bsc1088585-handle-mok-allocations-better.patch to avoid double-freeing after enrolling a key from the disk (bsc#1088585) + Also refresh shim-opensuse-cert-prompt.patch due to the change in MokManager.c- Install the certificates with a shim suffix to avoid conflicting with other packages (bsc#1087847)- Add the missing leading backlash to the DEFAULT_LOADER (bsc#1086589)- Add shim-httpboot-amend-device-path.patch to amend the device path matching rule for httpboot (bsc#1065370)- Update to 14 (bsc#1054712) - Adjust make commands in spec - Drop upstreamed fixes + shim-add-fallback-verbose-print.patch + shim-back-to-openssl-1.0.2e.patch + shim-fallback-workaround-masked-ami-variables.patch + shim-fix-fallback-double-free.patch + shim-fix-httpboot-crash.patch + shim-fix-openssl-flags.patch + shim-more-tpm-measurement.patch - Add shim-httpboot-include-console.h.patch to include console.h in httpboot.c to avoid build failure - Add shim-remove-cryptpem.patch to replace functions in CryptPem.c with the null function - Update SUSE/openSUSE specific patches + shim-only-os-name.patch + shim-arch-independent-names.patch + shim-change-debug-file-path.patch + shim-opensuse-cert-prompt.patch- Fix debuginfo + debugsource subpackage generation for RPM 4.14 - Set the RPM groups correctly for debug{info,source} subpackages - Drop deprecated and out of date Authors information in description- Add shim-back-to-openssl-1.0.2e.patch to avoid rejecting some legit certificates (bsc#1054712) - Add the stderr mask back while compiling MokManager.efi since the warnings in Cryptlib is back after reverting the openssl commits.- Add shim-add-fallback-verbose-print.patch to print the debug messages in fallback.efi dynamically - Refresh shim-fallback-workaround-masked-ami-variables.patch - Add shim-more-tpm-measurement.patch to measure more components and support TPM better- Add upstream fixes + shim-fix-httpboot-crash.patch + shim-fix-openssl-flags.patch + shim-fix-fallback-double-free.patch + shim-fallback-workaround-masked-ami-variables.patch - Remove the stderr mask while compiling MokManager.efi since the warnings in Cryptlib were fixed.- Add shim-arch-independent-names.patch to use the Arch-independent names. (bsc#1054712) - Refresh shim-change-debug-file-path.patch - Disable shim-opensuse-cert-prompt.patch automatically in SLE - Diable AArch64 until we have a real user and aarch64 signature- Make build reproducible by avoiding race between find and cp- Update to 12 - Rename the result EFI images due to the upstream name change + shimx64 -> shim + mmx64 -> MokManager + fbx64 -> fallback - Refresh patches: + shim-only-os-name.patch + shim-change-debug-file-path.patch + shim-opensuse-cert-prompt.patch - Drop upstreamed patches: + shim-httpboot-support.patch + shim-bsc973496-mokmanager-no-append-write.patch + shim-bsc991885-fix-sig-length.patch + shim-update-openssl-1.0.2g.patch + shim-update-openssl-1.0.2h.patch- Add the build flag to enable HTTPBoot- shim-install: add option --suse-enable-tpm (fate#315831)- Support %posttrans with marcos provided by update-bootloader-rpm-macros package (bsc#997317)- Add SIGNATURE_UPDATE.txt to state the steps to update signature-*.asc - Update the comment of strip_signature.sh- shim-install : * add option --no-nvram (bsc#999818) * improve removable media and fallback mode handling- shim-install : fix regression of password prompt (bsc#993764)- Add shim-bsc991885-fix-sig-length.patch to fix the signature length passed to Authenticode (bsc#991885)- Update shim-bsc973496-mokmanager-no-append-write.patch to try append write first- Add shim-update-openssl-1.0.2h.patch to update openssl to 1.0.2h - Bump the requirement of gnu-efi due to the HTTPBoot support- Add shim-httpboot-support.patch to support HTTPBoot - Add shim-update-openssl-1.0.2g.patch to update openssl to 1.0.2g and Cryptlib to 5e2318dd37a51948aaf845c7d920b11f47cdcfe6 - Drop patches since they are merged into shim-update-openssl-1.0.2g.patch + shim-update-openssl-1.0.2d.patch + shim-gcc5.patch + shim-bsc950569-fix-cryptlib-va-functions.patch + shim-fix-aarch64.patch - Refresh shim-change-debug-file-path.patch - Add shim-bsc973496-mokmanager-no-append-write.patch to work around the firmware that doesn't support APPEND_WRITE (bsc973496) - shim-install : remove '\n' from the help message (bsc#991188) - shim-install : print a message if there is no valid EFI partition (bsc#991187)- shim-install : support simple MD RAID1 target devices (FATE#314829)- Add shim-fix-aarch64.patch to fix compilation on AArch64 (bsc#978438)- shim-install : fix typing ESC can escape to parent config which is in command mode and cannot return back (bsc#966701) - shim-install : fix no which command for JeOS (bsc#968264)- acquired updated signature from Microsoft- Add shim-bsc950569-fix-cryptlib-va-functions.patch to fix the definition of va functions to avoid the potential crash (bsc#950569) - Update shim-opensuse-cert-prompt.patch to avoid setting NULL to MokListRT (bsc#950801) - Drop shim-fix-mokmanager-sections.patch as we are using the newer binutils now - Refresh shim-change-debug-file-path.patch- acquired updated signature from Microsoft- shim-install : set default GRUB_DISTRIBUTOR from /etc/os-release if it is empty or not set by user (bsc#942519)- Add shim-update-openssl-1.0.2d.patch to update openssl to 1.0.2d - Refresh shim-gcc5.patch and add it back since we really need it - Add shim-change-debug-file-path.patch to change the debug file path in shim.efi + also add the debuginfo and debugsource subpackages - Drop shim-fix-gnu-efi-30w.patch which is not necessary anymore- Update to 0.9 - Refresh patches + shim-fix-gnu-efi-30w.patch + shim-fix-mokmanager-sections.patch + shim-opensuse-cert-prompt.patch - Drop upstreamed patches + shim-bsc920515-fix-fallback-buffer-length.patch + shim-mokx-support.patch + shim-update-cryptlib.patch - Drop shim-bsc919675-uninstall-shim-protocols.patch since upstream fixed the bug in another way. - Drop shim-gcc5.patch which was fixed in another way- Fix tags in the spec file- Add shim-update-cryptlib.patch to update Cryptlib to r16559 and openssl to 0.9.8zf - Add shim-bsc919675-uninstall-shim-protocols.patch to uninstall the shim protocols at Exit (bsc#919675) - Add shim-bsc920515-fix-fallback-buffer-length.patch to adjust the buffer size for the boot options (bsc#920515) - Refresh shim-opensuse-cert-prompt.patch- shim-gcc5.patch: shim needs -std=gnu89 to build with GCC5- shim-install : fix cryptodisk installation (boo#917427)- Add shim-fix-mokmanager-sections.patch to fix the objcopy parameters for the EFI files- Update to 0.8 - Add shim-fix-gnu-efi-30w.patch to adapt the change in gnu-efi-3.0w - Merge shim-signed-unsigned-compares.patch, shim-mokmanager-support-sha-family.patch and shim-bnc863205-mokmanager-fix-hash-delete.patch into shim-mokx-support.patch - Refresh shim-opensuse-cert-prompt.patch - Drop upstreamed patches: shim-update-openssl-0.9.8zb.patch, bug-889332_shim-overflow.patch, and bug-889332_shim-mok-oob.patch - Enable aarch64- Fixed buffer overflow and OOB access in shim trusted code path (bnc#889332, CVE-2014-3675, CVE-2014-3676, CVE-2014-3677) * added bug-889332_shim-mok-oob.patch, bug-889332_shim-overflow.patch - Added new certificate by Microsoft/bin/sh 15.4-lp152.4.17.115.4-lp152.4.17.1 ueficerts4659838C-shim.crtefiMokManager.efifallback.efishim-opensuse.efishim.efishim-installshimCOPYRIGHTefix86_64MokManager.efifallback.efishim-opensuse.dershim-opensuse.efishim.efi/etc//etc/uefi//etc/uefi/certs//usr/lib64//usr/lib64/efi//usr/sbin//usr/share/doc/packages//usr/share/doc/packages/shim//usr/share//usr/share/efi//usr/share/efi/x86_64/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.opensuse.org/openSUSE:Maintenance:16706/openSUSE_Leap_15.2_Update/98c4185f5a43242d935d5eccb77d04a5-shim.openSUSE_Leap_15.2_Updatedrpmxz5x86_64-suse-linuxdirectoryBourne-Again shell script, ASCII text executableASCII textR if test -f /run/update-bootloader/reinit; then rm -f /run/update-bootloader/{reinit,refresh} /sbin/update-bootloader --reinit || : elif test -f /run/update-bootloader/refresh; then rm -f /run/update-bootloader/refresh /sbin/update-bootloader --refresh || : fi/bin/shutf-8836c50a8123dd67a96d64fb7b29e7a38e894ffd3ed8fe74c67a329b61979caa8?7zXZ !t/mf]"k%f?^x5kIA_nZ&EUuzB4hRNw8!$@#bگɯ/K}}$phVeC16y6곃/':TϷxT?1YBu.Q,!c|FQ_1kZ^8"S-(Ԕ Q98Sv0p=P.[ !el,,&|dPqg1dZqM" |֕H@T)snYRgHjW*5SXH'̔7oFJGG!#m :MGNfnyεlƂj07 3~a b!Y./}eR4"%?`'ZpOXyW 5&`8$4 r:w#Swu&]ՄhSAP0 VhҰG|/9M{g,.&CP<>h cFgܑcZ(oS]^X%n32K,":ŤfoQ<Ѻ@l~ \5qbguϝ ][ekN: 1Su2'*` Yg6)8PKZ# n&&10ZqܾK7̹wvbt}݂QskտvLq[*.RJuk`VۣkE?s=Mi@i(*<@04 2zuJ;׿KKF=Y1PYBkɝ^CSK9ThQy8 Kq!9j#=,90g8Pfs+p^O1M~|cTa°wa.%0Of׫GRq}-Rư^ &a}μB ?O#-U)ey S UPoTBIoHNCn\n l&>AM>Ʊ'!_0a[ cG]y2Y0@+9M`+g@$Z:m(+3/(>OusҲ7 ug}>;N\8`Ld\ ;TQst{_to>ОaqCr/2fœ١ EOm>I܈~;.7TE6ǿ O6Bjmt!:fTPZT@kHgmBԩe#3Xz>9U2xM@MRn,S}wЋEb/Yp TV(fq@4ˉlSIi^ 'mmN(?E/Mq>< jzcap!99>]Br'@ $-"q&П@D-6RFx= " ,1+g9b|Eu%߄NV֧5^:h/D N[mыnv7+0j5ΥN?ʤ94ʒ}Z&ʱ@C{IP^h޳ l 0\pYXO]H-aAEb] 1̠,ډTV%Q2WviJ~h x^ ޢT椻ier^I,P{Ȯ jSH&ׁATȌ̓vbO}mD?vh81hpA ڑrKo={yU42t֭[O IڥKnےdhG zk׻w{q"10Dn੯wC@B 9uPDxȾ(p4^8lKY 'sSH5(ڔ,J%ɞkbJD6<~J5>6;!QW\dA|ƂuQƾp{DjpL=/C/@u7<BkCס"T%˅k.#swtkcZֶ1Iö IJ?>֏z{YkErZ[q׿+)Dhy7R7imڳ fȝEv3 nw4o̺bA􁨭sr*N@zζ(}b 4+ãV(gۉ S/;ć-6j;_ω</`g4^z>ZscA`H޲j/`ǝ\mukCca :E }AHFz]de t]`$rGG"$;fOu:} U&dNxpEon]P9]YSQ[NcЁPNx 9cBH@od1gm@\4۹(&gx39l(hr9U9G7p~Lge4F؟( UƩTf4WaHAEPa&R dPIPLżD!Zѭ*~D QtLxʸxiֱqယӁjU6[b%S( XEM-(L[/ @lVeKMIKHcAw2.JW O!`^ur@L)OF4fA4bM ZI:W%INJg%ۊ,tܙ}nsaR $ޯ,ܹ> >ܹn1&%~ps/S ja&FՊh-7gKO*IuGQZGb+] D< fyWex 8}#۠L,eJv͋ʼf@L@lo_]C-54`k *p@C犲Ig$n>G?b33!}'85b D+m[a۽?XR ±ܾ3H@:QW6/"цqrrCbM_mpJ(d$o,1)cBjP`1 .  5kun5@H*l2oz.ϡm2aMy ^*L>LvF]l`ljnyX- :dL I8L#r^!A֙'?/}gGSPJ覉zn+D5/@QNp>I6բt{ƺts,Vhe*kq PoWg|(cC@j.y@=&K@T ! ;'MU.BaV}Ey;cS*>PdJCf:"jI3.yYV?Kܒ%iKjζNa}Ħ(~䧏Ysl'"-^q?@uYpR骡-HwԋKҠR>1.= $L3VjNCb쯶 S@Dɒاsjj0ć~Ӥerq R@_y} L?:_Sc8SW+qy 0Q*?`r$6R$;y3e,sO2~N/oU O!mW@X.6cq%'$ֹ}z21>LkV.=?͉,g1?j>0 1wlԋ$ z,%9ika9KCYmrS?rOdO.F͈H2+Pڼ> B(Oh?GcB9ȡ XzۖۮӪ`.4=\ 8~I#&1{lKP-:Gp}eo&BbXw yVmExcdP Fډ644F.#5'\p"x6,%-#L*{,՛\,|E5W蚔/~E s3.UYVDvzc>a!qrT^X(KYqw!(%QPoblw[9i{,-QKbi0c%!žNEbE j烶C !c~N,^23 Vib>7+ tKwHO#SmMRGu@S+?\z [jɗU\"lWp 5Vbo[Dm.7F ,%qgI# ,w~U.,ϙHfOa<i8 Ɨ0O6qGW?kѮ0wLΎvY5͕n8>P|`+@ &0=K1KkR-WwYiʳ# T}]Zs6X.)WW'޻SGQO5w|cw{.oj ֙+ d49`h+$#:ȢR!ܙJ> un>ۓ;r0--r0ƒ.|lP7H{}4jX.= apd" %&a d+ie}nC%z<?9ID%x*M@Ӧb!qp`0a' oHp2ۮ-ld 0{ 8o+QnmF h[F~zUy>K1/2O7~^᷵ vxv.}N5 vh.ۛ) iXxi^;4@pc͞fb7I!4;/'< p9%pJ4Kpg"qӜrz&%Ur|"ZIm/EBHK]w~^,N13\( ^jTvx:ezP/*avL^U(.+uf_J DU"e8T|ӌ ωnkG6l UXzE d+N AD$dN|ߊʳ06i"NN19="s\0=k\m \ h\fqCи_Q=Tp$zP;̎8AOAi O1 nXҥAb+Y^޺q0Z' ʂO}#==#@dAzXJd]֏ߪ 6c՚s !WƘή`Jw(gs!p,5 R,$ƯJOY-HW4KAD` ?Ы`ъ6䬳TD"l#ajI%\I軭K H@0¨QyYeP`lU`A^Qw, 0>?v)&yeY܎]ؙ}.fSNDW =b]ud,;26+x,;ޤ~X Poݿmrr'^V%Sg`"@a2V̒%C\a6`rQiomSZ01o?gX5d(GU+XճV3.$P^irN ejI=ϛ+r8N.9Lc)Jp(YѤ7`ott@jh]9 ; 5~]K CPT"QVZ2 }*ptбc j ZgX6[K*eL5I?z0'_dN;j;X.Y0 W(e+fG:uz/D1ح{ەɿNp=tH8QGkPO>)#[鴘)h ~Lャ`(oEM~;7hjCzf$lϝZfr&z@l $^7Z(CQ)BXYHz4|U/>VXm X fɜk82apH>_\`.1$_ 5 {N;4'LZL)kPOa)5aƋf߳JX3]d)"xcj6 aT׽:O Day}E M[COq 97$Bvm9P߻`\(4Wiը3S`Pf*k2hOA*= H8~-wNIdیM}"@e 1[fOa{O@z]4n],JW[/twTL#ےy~E&3[m@I"'7[w4 uS{tD 05S" BAǜ??.FZdl ;#-m}Zc|'sPq]s% \3"u(E+VaA*'V]8p7v|spƩR0*$7=.߽;}@vі-|YEG31&5ZP󏥡2p=GIr{sC&y6/Z*fv>l 8 V=\:jHݛ|6xRMk {N%`OsgWг-4VVSPH"뽭h !8Po Ȋ^4[ .[jZ1uv]$9:}u3Ex?x6;B{/א_Pl(j _G)@{{&%ܼVS^Z٫_mC,>"=m7/,hr3Ԭj>oW*amRc;Q3-Ye-"n6svb5Erj_LWS'uLuC0ttIp$q= A5$E lKTK0Nhld[/63%:h'6.f%*"{ z)h麪²U⧅NS۷ 77m(q@/I9>A2+h-`r+np,CyE*zFb䬎!$Q߮XW0+`C8@U32gТA{h `l54LLwa"2f 腶p M.W-ەѱ)@҂!Y,];l*l4:ͥȱ,T1WhVL,CYk1<4`3g1 6Pכ}H+ee4NC#5CՏJ$ qvc l, >KkM|AG|m*~[ܝlͬ} k8Ė˭F6p74MbUϩfdǶ#6[߉ao0EW-5seQJ }TYۄOKP@>򇒷`tMJ7|[2zSձ/YAl\4)P$_VxEY =}s' ǶV_h\-#(pFyC'RzHeDZM1Rc/0c,>_ϸ ? TTl0w/WzoGܛ;U>mp_9~Џ R txv6CGHH h v< xB72 &o9=&dы4önizt-@̉ɈR6Hsz͂cָ s%]47 6y]/c^ IdvnB =OORRJ.-'Ke@Ws$ LLɱr253պdQrl6%4Wl$61QZf%^x.VIXT],'3*#nFb^[y*2t4ǎE|.X{\ȸȐj7 -X?\6ڳ!ٯOPY>4Dc@]%ĨR d+| 8G`U0AE=zwWͫř$++n!|u\u ,$a ZEDqk ^gϻJE ۗN=cPXEQD1X,LyMT.nU #`p:Hu)Xj,k-C=0;yx܆_jf%&{58׿6R8N=AXwX\u(MqreЯW(duie8߷Դbad+E|EuΕi֨f3XY5w`dô`Zm^5%L~JPn"䬑HzXLL6aRpT[;aeTlF-x@Fx/2mjtAWvm ,%`@IJTB삽$5kxU/a6|*ɛb_:>?@otQ~(^_A?[Qyds~lYp6xp" G4tzn93}%xP8D10in{r?%(l+"R&pw;Ó90ߤN$ZSw,}R[J<-*== 5,.`jF1 o<44mL> ?t?7ȵHtp"6|?ͅ퇁1{ Ҹ(3wkۣ|.$9V eXHgۄD/}?-JS gr13α~ՂjCyw֩(k?b*ItbR(46-3.-|"l|'W fiMcʚ,5>\PXſpQ?`+%y`kMT4^]<++5Uڨn_`gr3w:͏݂1#EsG9VRjmcNz-0+cG?'a ,P^޳雷uak+¸\/\NK(z6FA{C'2Ae+[we/AMSOЃW Y ܹ oFg|kxB3M$`{W)S$2ۆsZ Jg<-gV@Tl`'%Sftdg֙)V4zHŪ<37!5’IBMD}GU2ic~e&lnV- ߐ]DpwKڽ .sMh?B؛aeGJ% HO-yD)aGf*,ZR@~;n5"O8QNh*w07?R5Rt}%< l; a 5Vk ݙ0GYWx>M i:'3)u 'NwGfd`'!Uh)@sTjӋHiyh=? 6MX:ANG zT)!>ّ2[3k#8C4VmSgȴn@!5dQ;)e hŌOaHYVL3;m\ 5ֽԘ"e%l[nRs'e_ej; )Vq!noC%d c^,:=ql1q.r'Yޞև#w,_smɞu%ysLdӍB%̚Wvr `:IjQ~bc#pbu 2. &)xi%8 XGB,zg'oI*j^^}/UR/Ⱦ YoW+xnrP@'MBԠ])T}v;t YӏNQE A\X$g)8J&pՀ:'AړJޣCԐ;FPtUsD VyM Tοq!Cgke1xE:NV$Y+0[qɝ0-|+6r%j^Po} ^)0kB,p\v0b0][8POJr=ëؗXGVmZ2aJʋ1"c eP؟ io(Y`8s] &B]tap"s OMGҰޞx`xrƶG9+d|?I u*8ŽAK9[̖q&|*$g%5gQ!n ~jRL!^$0Ǩh,3A.g~ RXwoV<φ }ޓm ܉9SMC ,tuUoӈX/ p'!$`<5yg/nĔlÖeF .,C\ Xp "9 r\|Hsy$8 ﶚ) .Πm=Lɞ&J;ˌ-[2eG{NF8 =5O4bvֲ?iqS[REkRah8{s7P%h1Ө+FYT-+zc"t 2sS0o.7?/)e% p;Pw9/{XŲMvhZ5F2S$T%6/Х[u5 Xd_]ܵV*GxϝNr:c%,2)q|]a 6 qRQ*d4}f乛]:bpAIrXp]}f$hU<%\$Eez3^Mnj;3O"emi0Dqpzk~21I&SUgG@_7Js^YzҒk1\sް禾tXg*ŠUJpzfșxN.z]D]R'NB=޸8B >Lc{ϖ/Eoٱ]!:g };pX~AsW?3O|Q9.DoI,f|+r=! LTtIJ`a>?@3f4Ĵ]UQ2-^kk?k;@#fF,כ׏i _. EckOjT9(CL^&r,_6EySeekbXΤU>P\hZp55L:I^mcй)P aXWL~k7ŷfk/~:  K,f1 wx62)Lw3ap]ARmnIΡb "sLND24զ(-m͆䀯5ZO zQDFyouhX%$s%$85P̶3kS}gS- l X,i /]|8015x4{:;ǰ(FO1rxh˨7L)zMl,!9p:'uxKQo ]$Q%g oķw +vlXA0p,ڝy (KéQ#Iy|T_]Я\HErM9CmF`esl܌幵},Ce"Dԇϭ owu${33; .녁Y|T\:8?<"Uu"{aa0`Y#&ɇ+WKCVkY1a$s󝁨jCM x~r̬o]y04M!Mt+ob,O#v[/b"F_ 7.Kcgti P ZP ZkUX yP+Ř:2D7 l)VNt=k!` mN^0xw8gkX j|ZRma^qOtuxyMO#ARE JyOJܲ1G ] BgO HQNdyW"H?^6WKMMY!aC*1Z8 ;o~I@W։w^$*o_PLŸ}#aD3dI/(#?Tt9_&Jђ*]M%nNOm0{b^[,#(~wIșJׯ:Ѹ@,&r"8J7`nQ~1!2Չʑc9i %onF̵eK|/df },vmM{J\0AlKA<61]|y|8'D P(kFPU5$Y17LGST.cp #$>ƫ& yGK0L:Mo?K 'kl9trN`wGjXൊ1. h˘+w@ټ>9Lx%rؘ'7nlwIk9Frã ~E1U"J)ծ:Tg>%=` ZyKh6/z|NԹ/}M1IP%⏃U5axT>(kW}GHBv$hRsԕ L$c2R/pq65 w@=5LnvQPNp@ 3W<_IsQDZ&[~y3㗍\ UT43{Ä4ebj6 K[dO AؙkAdA "KMUWz_Y/.IMPf3Hd:yQP&SR\=<4I7Xn3rTPCo;t#jlJ}vav9Bt dTc.M yIn!)3<`As➞?ۡ}*\=Fl~π=i=a((zspsʚG~$X}["{L=Aߧ֯Fmŋ#@Mm0TR f2WӓLx}Fnjcy4{S ;LB"`zN}j*zyN{bLzW?yB -{Jye a7aČ&$ =^ȯpxR"v {ۡ\ueO$Qyme8NGbsF=A34.~ƙtw,Tݾ29Ȱ3q">Ӓ&(S@[=ukhf[BEߌݝ2)>l䪹- +[DUksuk5\9w CCDnd6Y DBDZ71l̸yL j$ŝSOb?I㋫.p*Ў~y^g Hg3ʔ&| !e'f@ Mボ6ĜUи2j zn֌+=ۺ=`$oۼKa5a6226]FdE .!jiRp/#hxb@KX$J q*/]c+WLC{[!HOBs̓Ur3Un`h=Je95l 2дn-u[韈/nMǮػM858R5ہifpөkՐ Vcz|4t"ҳKޠ. ]4@&GH0 T9o+;o:]_l!zU5+KE+!L{u;F!F=GecI>VlWhq,+ fcy~E| >AG-D_:hDe 3!# K6O*!ĘԈ9o-M}9bH>H9 f(i7zq-܌+"X.O NUnkJp9zHex):@da3䀊<ޘsnԱI]ysi?EjU#j;5p^ܦO5=#WXO Αi3Tv 5/& қBz.Vaxrʊaubf2pB{%!-=;𽚜pX嶕qs%d$ os nL*x3 q #ZQu`+$͑g4ffS0m#G\yIH0PDХn`ثi&4+$솇gy%ׄtQ\?'|&tpb=24[xz |`/F7sd :=b ;)Jx/;s_-c.Me$,Kw^fFtojoc83 @OusqYȒmMe9TΤhLI- Ѣ@KC^e duKZRm詐Go֋m U}?:@n{^*QD+ ?qH뫧5iwg^l tSMrӑL3ر,U=2& Ȥk{b[>v#1AJ:׉0Ojekb ˭KVkh}@DLv73C9p:.kXy2+'Ϥ>- #=FТs $J(NwsĦ3yx1Gǘ*q*sH^l T&ŗĤ`\5 GR±1$H}fq}NR 3J &J-`Ps0Nm,zS:yJk)q&l}$S3ܡ"9PvwWEa aƜz}:)jn_zN@KSO%%͚nSHg` k*ٞ~XhM*]v E˸3BHU-ԁú?H u%u1TщKȐ p83M߸0]szv"M1kCk~&u)J*#igj#yPvxuz~&¶@WçXh TuZfldذ\k) C][:;;긏 m2]xUw+c+ ȭhaw[}0uG^+A #}?vG I#o7ȴFG zHѼ,ZK_ B<6}Y=֚馹oU:ښ㯚7M(0"ʾǽH\ C $HViIR[al,n@٣L`?j"4dEUq3iCvZ|M'<ogG\-w0^MV|SgUipgI'i)ӠMFd-^3*fW:eN*X   nҒ}thݮ;t{y -s>]YYwx kS<([ i˸{\eJ!Vko%ya&Jo)M| Oj\nrt4O5׌u^~aίI쒄2Sg56Y]$}KfɊd9}v3<(%߃/F~rNp2Jh]JNTĄ3lR/Hj! #]]{s.d,+u!EBzb0r? Td$?W~o]S+w/Pi\pj\脰OI}6x%i's̽`] %gg |XUs2%j A<뽺f:6@t?]%:'7;`-j#_}b'UqS,^аFl'jmDoR"Ks{5 +MBBK>qb^=%V,WN ź{+<`OK5I(W@)ecL)bS/SXHVRm*(p6C+{PtZsuHr A>ٕk=%RQ/|гf lȸ#. wF9g`!T?t'oB2Ҁ<\1ጹԺhqr$=bcbqZ{G&j`ƺv!vz5ݠLyl!ݙF,؁I5fg(Ngi _'5JHCJAY!8NSMk YH":'5#W!'.ҥ!fnx]y{xb: W\yՅ܊pvm?{6q5H3DTÕo<2":P%+ (AB xyzbC2||m-@@tfd ϳ;eMϔWeF~"$^UN %ŋaof7͗ԋ&tPr1 -+R{u8mHr:=kf L(0r(qJm2-yAgY])w{u6/P1XsVQ]$ 5v ؼI=Þ%K6q= TWk@ 3$h5(4&)] ate3L A-wo@]S/+[q" o8RדxWvtl՜+;Ui z9թ[X*1 .NjM*\<1JOD2q_dك !Qr鎀 \}??c(Rh:Olg; f}|jG[_3fuUUzV+e Yy᧺:epR(`ûՒP'˸XͶK}yi??-IR!6#@:vR9KTd`,ɖtYweۗD5H(G dlxa\. ӓuV}$910 ~K5us[yʉtY"Q,br_ "EOp;3Њ ExccDU@-peᅩ>& 6e\vd#3FHFL %b\}$9}Tƞ'Pib.# x\0Z/fIk$\hܕY6-OzZ8 & g pRg^h* ʩwvr ϒN|!:HjaӬgʝ4+d9Yw0PF^RVTYχh&)BJ;7>Snn<|SkvR Lܔз #A O耝ɋbIX/>9ꕷp<1uU"&QɏN|v=⨅ֶmB[l|?lm="'vYtrL cdUاt@;|o'P1,6w1e;U]ӄdcN\"w208rg<4;94,3i u8s;2ѻH@1X3cj5 9Ak;-f(Zcl Ћ$m Иq m㿸eF}| *Jvr&t 8r qΔ|qekȅ&:aYѫAj*F.n I$RanM醃ŗ![{-& i@:%胖 A8N_r}?ֻPi$4_(PAr@F@6 7֌I.J+. ܕ0׏fU休؎ !Ƌ-a>(|tKX:WWP߫!Me*nX #dfb'ܧ!Io1ҵIg#öH5r- }TOnZVZs9[EY*[i !/A.bT)j/MM#Cnq2}6NT/m=Y% Z=HYMy^ !#O3U㹨р mBa;ɴoKJ_\?6b`IQ'v.݈Ȯus9K-;!y+EQ\ <&A> NIԸO݆vg˰n/df*1k~o7֪Nio9¡G;q_ ;k@BԴ/0juK?X gpҤEDA9C3e燁oRp}H nSVwj˒[caGArp٬&IgDnd<1'T>5P~j>X㺕A`9PZm hdG\LuTg¬k,Wg~L*=3"}9=&lJ"?3 `KXqc`ߺՒ t 71Q wU04s6(t b'[:mxx1^#^cٌ+˘4(b"(B @kw6*Rޭ:,b9 1| *&^E M"sM(ӗH祣aFcx1\q?`KO-8/e#_)98i)&8t+iLGW4ʩ^6+ZG˺s~d7kɀ.Ffc`g\wSM雩6Фq}B(u98|Vʕr]?1>ȪvWo~J[UwuXʧ;`3z $"31U[& `nGirDplKR"\t"+`}{[0џGri%[Ҟ'SB%t}S|7% ;ȳ& ] x4`JwB)mւ|}(S3]v4qg^?S;7(*3"[NjZP nny5d1RR5B+NT1=ʂ]P*jid }<{Pg{331 YZ