wpa_supplicant-gui-2.10-150600.7.3.1<>,j\f5p9|-x.[9? 7a@oY?$hkn$ʯ*(n8C^wA & 8x"m;ظ'֝b$FŴ;J%DCCuSsO 삩[. rL+k#5J5 >hK>P?@d ' J , BNkq|      *4`h$(Q8X*9*: `*FtGHIXY\]^bcd7e<f?lAuTv\wxyz<Cwpa_supplicant-gui2.10150600.7.3.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.f5nebbiolo SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxppc64le 큤f2f-c803418d422eea51dcf98d1ed3cf0d41cff29e9bd4176302852c37ad4da0914fd57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.3.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(ppc-64)@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3e}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)nebbiolo 17267464212.10-150600.7.3.12.10-150600.7.3.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:35766/SUSE_SLE-15-SP6_Update/1481ab215a0b1830ea80ceb6538f4766-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5ppc64le-suse-linuxELF 64-bit LSB shared object, 64-bit PowerPC or cisco 7500, version 1 (SYSV), dynamically linked, interpreter /lib64/ld64.so.2, BuildID[sha1]=481d95dc57295ce48a56a715aaed20f22e921c98, for GNU/Linux 3.10.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)R RRR RRRRR RRRRR R RԼ?Vutf-89a4d0b5e947a44ecdc5b226dbc599bd6d9b7d62a44eb0a64ebdd2577080d0c0b? 7zXZ !t/6]"k%{m{#rD~d tGJf͚uo[ H?L!g' ='fU遐CZgV C~ӽ=̏A ;Ǣ?88 WwI%M`YlRl ͕\k5eч&x3Ҷc 8 C kĘ(Fݟ:Q@bIv_senrfЛ,TCļEOTS9D7&xHR[ -A4n<T(~)/םyteӸ TXp'1lA8V^q7_LQYFݕ&> ,Zmx"昈·2:r[U= n^y=WMSE&k;Tsϋcx29jIK-$ Xk t-yZ>#Wr ;ӭo98"{k%M!YS9[\p杪1+  ,O(B풦f;qFCBk(+ui 0QV+|6ب*UwdBI:\sJЭhn2EJ?aK-ӳ++r)#%# jV|ȰDy *>ݍxP Qfin}uI["圢0tK_=aH sD+FOp޿cXFaڳ%uxa4wn 3ߩ"^\m=i{(,JuqusQю0ކ) _KysW/`e(E*R5/KbZfqmnbן%/臗޽ǺpσszΌ9Jj 3^ڭRQ_+0qޓ =AUײ op9 7^Qr?}H零ctWHd`l\HHMEmpI`:zJ]4u/'I+[jT6<8 ֓v0l:cl,\6AA:UGߓ'1kbH^<+Ekx)YI,j$m PNL7ߞ i2 L 1zHOo4Ǽ% |s1B;l(?=  -2.G<3eBD҉h\pvc DQj1΂Y$qQWv,4t^¢1wٲD!AϺ>럽ʒ1+ dVZ Q2:ԚSV$T/FY+-H} nKJ]RXͻݬߘ>Ң\t&}KMc M jkI$S4ȚĦQLD8vVy[r禓޸G!&--NΉ[>wOu'#g{{yLQ8ؼzYs;j`"~t>ќ!ͩbwc @jFڝEp1дsh+9;s`})hs :!:'~*Xh{H`uط4BU (eN5q,O(hRPOq;/?IE VmlRy Te1@ҡ71s/٣AHb`(.."w~[Jq$O CPDwСVtT"!#g%o̩pEô+z+!-X\Z.=,fRQN&5φHtMz͵f񥼦אGm:X#B.FL8vf\)ά!T|1Zx}X ߍr~yOg9u6ywpes'_kVKܤܩlL[gDaښ]pG_ہ)HOJɛ  e_<Źy} Ytg `;x 8M )x.uk05]?:fJBH*+<A*Y…F˥ e97 ;'U 4}Lθ&!lwhReIqNxVUA/&>D}V /mUvV_2r[UYm[h,)U,+(fNWk$h`Vɬw)`n~Cю@u~KøF~9eJG8uWP!ujr+۾- +9^۟1fDJxEnt3L-%& utѮd v=zRZAI$ui)BW Z((rDJ:l.! ^oO >_~DLOF7r﹎?vCFNOq)=?w 0J:JD]vǨ0F6o>fJVy n4x _ՑʪhzZ*(a4CD {ulC¤sBw}d+| l}yy),+pqY'Eq<'HO1.~ޒQkzhv7ÓH=?" kHK3@Gdϲ\1 z*zp U87$0M`˱MMݚb/6yyvq2S{\'lh!/&ב#'u^U M{#jSFbsWp 7_C=[)d#~_1Y Nl[hEN 8rK-KU#,3k y8V۳|v\ЎuB{3~ԯ6ǜhu}/XX3w[[ J3+7$j艦'YE ff|)Ff.w oW0FLvғ V<8]?8V׫,8Vkz`WEN_RsR R 7 VVB75[Guy*ۮbCL#irv)ti"nЕ끯,\eցVBfR:5cj9An'zN=+Os$*pˆݺN^g߸DVTIkEO ʼ8Ws~JeZwhO ,jΡfb-Ы8mfM~V2c=Mg'tP|fd/)=aoT/5aU=i>'tiGwې]]ǥPNBwͮp A:r1yķ}#r4p0 Ϯ`}%[APil2OQ]Nો3. WCk>w%>?UHY0anih;e|%jzYW'>& ÒG'Xȥ@>D; q:.PrD6h7c A`W{!3mBw-?g Z Ȕ~-E`Ye€Mhvc26|ۺwXk) <_(&uk(݀{qLKozYnx9e &UMo_Zm@cC|X8 ~2E OU SwK6\'JY#dQV0z0>FMfGbJNacNJEcʟِ4[AA(rM)`윱Tb$թbTN֍l7x^FZЗa;l މAoa) ||"^^hnO Tg$yjQ!ЎA&3M ~EzѫKMQ*IJ54q악I[]\t#物m4~{%Ib)X#H|pHiQU]v"d â76bQzfh1gUnpOM6}yT*oaqHH<,ODv( wDikJ7DSCY+M*s'=GGfT6|ȡJ-;\rp50Ǜ$F[>eR(*Kq ~P+ǀ54^HdݒV4D|4]ry gv+䎀 loB }UϳQɮ?,US)Z3BPa{ |9=,\a@T3}Yvs(G0aU{" jt[aֱu}=Q!Ĵzb5t'+Ad c ]頵>VU`rrf(Yǯ #T3f0 >J4t%<`&ݛ% YM"(9|p3Lv*ލni-mdΩgnb FTB.ނĸՕ]-N<nOc38L- Kz{.W>m6-v1T]`+}ymӐqNbեCnR]'ZxأJ}BJsO骡Le 9/R  ˎJm83y!J]PH\%KY GK{)Õ3ͩr2e-إw9o)=7I⹿P٠K'zo{S}6XduZ٢A+K_w-# H_0 &ADVgw֪SlBC45F%Л)Ze&]Ŝ֭@s(E! "c~6!$Yzh=# :/Hk,|\KfMTw"%6O%DWy̮sQ̹rIF>qa//F6 #rĉW_#> u֍f¨G姞U,L.I@yt#k` JW唎+L|*,Oc(JEhn_AI3_llLX0,t;/]myn!(fq7deHG0E c@+:*LSҊcH A+hyƨT7:G&%  5}/C\L9]]fp?8vO8%#pZ˞(!#+3q $ߠ-)z\kPdן$"E_eaBQl3;e3_r[S gXvmWb#):nz 4E h (Oe)jsU.(DWL f%Vw`Eڬ0zѠ]ۦ1P"}r?0<bZjϭF{c<+<Ǟ)[ftج'-<,+^Vhʼ%g7>Q:tXf +.TWYO_>47. 5Ia|jjd[: VTY݄.h =c~|AҩQN)$&>OJ(hnU$q N !MċJ͜8l 8P6xJM5vH=Jd)TB#+ w=J"R,vpIIE45Oc_jr40*UKg@. 5V$УCn$xTuÍPYlʆ3u arݼK: B jڧ{ևĽ; c]hr(F#vÛ&:ũ"ˤu#H+XIs|rQkz<=p#C2q̄c{~I&:w]\6Aa^]8\tyL=m=mƬ Be$W (DGpom~^eaƷiFC/k%4O EBzŚ4Ou_7RSnCKS?pN+0د8uA'H!@&>yzORC9~vo@$^p03z֬yo;)ST~9ٮl, a@՚7$X笻Ba$ &l@nn9W h_AX:xmCwC@ͭ Z/Ic@Rՙ ͫV;\v ӂ" O'ilX ^"Jj׾ #T2&eMxisw7.."IfbwӗY B(<2HkLFailۗjɃ$(XJVMko\ {/t`K2toX,J ¹MHV>(o"糬c8["ZgB=0^RJH ``وj%PSجx<暨gBpmBgb,(hx~KJ9ГG1ި%\S{RHۑM (җp n3fSiM SoZ3f#ҘtbD[)Cbᕫ4^ w&, 6ki8*e8fg|sMpۍN e}4!:*: 5$ # $Fu1f+-֝|Cdplyw\75eVLVvV[ǔ\2b[ Ҵ̵.:[vlC n0ejaHY^|2ȤwzD\a!e(rIu靬j$5{1 Az\D<,3ePT{Y,5~ @X8KR'+Ep_otv\qJTUzuJ1Y.54gkuoź?2 z@ͼܾq8>tmמv8UM0gWA,Bwb)v:3gz"D?# ȝ"_dܚ_æ7 t+𳌹6a]%({,|,47xq yA}iQ*OFv9y٢0$hr$5kHtzpk/ۯOE;1 U(^3 TN>,MMZ‛| rseט+w @N8q}`N+W>@<ʭdd^!N߉\(,_Ȇ]iȍ*4Qf*_.$w0@}QpdoR"׆|96:$TQ.Unxꏅ MiY OseEb[2;;u*`Z&HI [UCbrwN6 aec Z0N IAǟimЅƵW4T.FNS2YYx2ƖcL<ۏwB=Im4ߩu6h%iPY$M L}%V ~Bpta}<:^Dm?'T+' 9b.CH_ǿqykM46bu`M[voȉ>&ޜ0d:WVZl uJՐA@/b4@s6ނ7\2Es@NN2I,e6 G>_qo%D_0wttXm`4k mxi2eO})c(7>/b_?c搞?:m2OJМk-jf}U|Ts1z~)gDxLW4$] TkwONzURzacCnj]k,͍W\Z?<$\@6.PBfb(N2Yqz߁GZaVg']_JZe!Ca{܌mXr+۳>ivȕÜ-]+ ,1@6$8Kas\6M) E;Q ؘ?yG͆RHA&pՎ]+MWe>ɴS^Q+HN/a_߯}&>q(ܗ+jށ )ы<< ֱux$Du!KRe ']bL]^ ?&ӦOl i#},wow-*?Z?*{{GOEmƟVu)kCBo9ݝ 26T#z#R E@5А#wyri+ f  %F 9+UͦZV+3uMJ;K1,@);\vRO{/:t/ԍG VEkdoo Ix%am׷$<5b$Q.e<nw\nҞG u2o5R6=QceUz}ui6wS reX182294c+߅F6TP\&_OfAݳTI3{0dꚀ0_1(SmG*M4`N5GѤR9LjuDdR5Q3_򫒗˫StFҙ Pc?B0F]=F{;W&v~cqEW;츝{L8f`{Y6hSG#5{~rz7)EYT8~0x'%)ه߽^!o@w`}30J1aj.p n]toϛ@d_.Mpk@2ZNaH?,.L7[NώK16Z;7tzW<#HPto])/Z`({BmћA5^dg_Ť`N|<.ڦ2n;v20߫K%'!y.,|"7-: Ax4\-9 1BT FGApwQ<5MJ}a.lh;#!ۏg?MJl`u=I FHWEt<#D,%pof+`#񜄤Hvb(ATC}.zy){!B\M{177gBzCһtU6b\R;p|:ܛ%IfnL:r)Y+pTuFsK-ÑG, A)FkR IF鑙=~B۸Y͂Wv-4 /8i"OS ? q7$M7!] }9ah~veJ CgA68Ǜ@Su}]O Yg>,_:?rrew\ c7g-06~MOs ?&'QA 6윴G2@mYpl 'K[М 1>mT]gd` \x-,D@`:viYwx쩁VA, Iըei]  T)CaYc8F+seXi#`6pqByv?>q_0:']gdRS-/h( ?Cz$UW4_ 77]VzH} z+^A\KFo3Z[P Nj 1ӦE͉ I|Q}=q\I,:o5{;;:femGrV"~1顡ngtIbOLT;{i$ʮ{K%p+|iw1$$&pJ&Wm HFM?hswB- 57-02i$$̼],jMkڨ#/yҧ~_0E'x$tՅ:dJ\!R&|O(i˶@Wf8LjX6*r|^~$!NC9KJo"Q=I;e%QS;Xگ,9O~4+6c qg 6`Gc%q;B uc00Ǎgb tR0KL?3o/./ՇC^]L0v8%yfh FrNROƔH³kgab| x{DXFGeJ2o~`/yMq #xD$K~OF:H 1CVq||bD1H=G\HuNR?(@LH ǖ7ĺY+ݴuN]9q蝾hSBOeP_el+Dk .^@s.,#T(vN6`|6|u( fL/v!W'{{XMAP#~*[:ͯyXnN'sWcp e=Ou cfsRL[Mя V=F2Nf*w{Vc,2_$nNj+ Y$un 2ĽUI}E)aTC.hm*-- T3UrZ=M}m/-밯3~lvj XY%,S@F{J*.΋I?]_tC7~ZyeDC%jHk4 W0"ƺxw+%_ ' 'v[Ni:w{lAJH^ ȧJUA743w2QQkUT5yU%"8Lu iJC5yVTS,)- Bi}5f)߈-xW,BۭʛKu8L#,$ߔUAmD@v1Ąm#-ZgQ'؏(+3v+lMqOV3[Zk9p$b`'18^{(`|l嶂{;ZAu 5W10J!Jܟnyn 2 Vڒ6~Ô{)RPFEtFY"=w\I|yge΄޷7)&$9'2+ aD;aߟBj`.@!@E`k2KVƎX -WиaxRwNG"eȖr Np vŸ\-6ğ\. 2B~yA[qQ+4+M^zЮO6\8btpYZ.`c3 38t508jHzFjڮ,]ݩnɮp'p}=XQٵr9olT˴ؚɂC蔋mWV qY̢"':ܿ"]1%AZŏ#4,PrC)C M7VbЎ{}1qAHywnHL9g)YV@| /; E{R?<:Ї C`p.QϙS$cK(NV3قl,Z!. r;ILU0/eƆ=8E.gC  R y _x?omfOaA곊'<*oǾJhSj(] /q ưc#㮞WwX7%qvdxl8LEQ9۾$&%>IMoi[hE"yO)z {%mH2;o@9\ e:C*W#4F~|Qg/Msdk8 XeGǢKM$uXoo܏;w$#!T$Y9¢"&Kp JJ}3`a =(aX.-iwOHipƮĭa& p}o 7eZGB72`fMiڪ\꺣K#رFiWݬߟ0&ݲidN2lneD%㬚RɃa3 7l۴z%/nB{Έ|C~n0ض;,[AaAF# ΒFw@>{eW "bJ[w5R(Kb5:81xZLc5p(η$wd9EGII =iZ+ l@C (WFUw H5Ww?ŝi*.z#& vRܭ;xTBfEt+5Ӆ;nՆKzJL4x8y\Kch? Ez+{j?om[ 0 rOQQ̫޷Rj~]L~/?M9/2> D%$Q17Wa5]SET5*?2c7Rh;ϤN Y t2(j*)mqĢ!Lzݍ?BM^"׺#L }p,mowQ(,U?(`l'8 -掷AwHRz4B'v41 1m&NFN։s}4^pFOl1F痄mgeO(5&GB2;wd>NeV"^pTTj]kr'; .,J^<-z˓uZCzīGnl>u|:շ jQt@,HF ӎ q}I;TE컸%wkN/' 4te C$dB 6$x &Rk&@'TH}gT¡QB*4B`j;{* QqZ uq,I-ic2#|w{mM(QXG6] %U 7JRT 7B=35ΜSbc-#ͼEXgq|S#dbgmn[3Y`qbQW,5]iXm,ĆA.OXa>'/HZsa:B tTLE&f O/msRD]c6IK29/ƹU=ͣӠ+{(sj"opn9H,*QP("Bb\&]ym=2Oۓ'Gb%ɝt*r>3 i8ckC6=63S>]k^*L_cXmejYNE)^mٻA5+!(+Qy.M67\0ۺ,I6&mBY{8hq'ŢlB*5RŽ D4)nr8laNf~Vh&?LsDucW`$KanUcu[RZgDNpV<&]?Zq?Q'3t=ff{֛Kr&*wސFrObM;э,fL.)J0YX;D34˅NI֤x(,N F1j86#:Lgc]weϺ 0?N;,۪!mQWKӬY . lY^+dt t#JnT܎({BA^0˽Q ,mf0O"O.iQ;,c쟼>h /9MQ{"3Kx'B-O_rꇷXe}6A1AؙV;{J\jm@mųk;.`zg53W%2qDtkңNJWc6VY eشظ9Bܳx7ʦ>n[Qd H!fl7o5&:_Tk/IiACIPn ߮;*4͑I&<+-N9ZdVhi~OFtBB|BnpB Dw4 [Q-98>޵1v/܆^W/'Fu_eIZ}}s+#>#iϭ]hMagπQosg_U0kK_WE@JQ8ydǼB3' TUX`Gpv]4l *-$yU}U7;p ux{RP}e3\wƜ6e}ii&~4. +T\r1!~rS.hKwDβSL;w/Cz()o3`ym3pELd\<"5fƂJ#xzr,W^łH撘 k9e(Fm !͡-(4Fk21Ld0LN|&0eJH,~iNDA+r]:5fJCx |4Kyں 16?#9ٵvUSoXy%HP%bS=FC|!t簩cQ?YaĂ+q+GR\kĩm A꾫y N,O~uoy0+& X0_I3aSQl,+?\csά}#{K6` 1s?9х  [Y!X"($=:`eJ~Sx1yC0_YllȡnD\N20=/,u5߄{Qg\F"~YOߠ qw&DFlɹ]!/(WڅzQOV4'q|mvn`rDDdyaF]{)]ts {N!y~<[例YX1Cb7^SN:nx^œ_?,4CyKQ^ˆ ~gX>^}NOlFm{po'$ްaIjm.(nBVzX~NQ$8/h)G e6x钂-z)٬BFD&44ơ3Pw5JT;q`w{ IMҧEz\f#r^N׶b6HlsDm+ { T>I۪¬E! ;(hmҩ' S"c|#^aENr Fu9`o; K摼T]s4{a3IQ5K#as)3*Ai5Ef"޺:m% dl0&e aүWvyko.fi~ܶH`9UXw7_EvKaɨXn s}I`U}2z̝;\'°&?i]NE-uc0Dںf6δ/Љh;>9ZkE"rr;דbA Nj ͐ ٓߛ}z1&ٸhq7A{`|i2)B^gھ&כpv6fGv nsPؽ'j( qtֺʲr7+1dQix:B{O9h+)a^w^ov$,P@& oGElW&8styn~ᐪN&#0 Nf}vwm)Eh~6 [ՈY'/mTa;s]P]ҝuDwYDԍ^pRMed-i)HaHjdHu/` -ib{ɈN3N7Dm`Ztn!qGC3f|eyȧ*y~?aA a򒴫XO$3W-U5&huYJj]m~p D^:43Ʉ5vcq Tk_w]D2=쬗X8Ex6]XͺK`fH )*_+? BLEVjPDuYoFaZ1j@;Og" j,)@`eE.>a:-!'A:ⷼ{ []B wQ$8rDHO3ǦP*aEP_=4rޗ^=˓J$ u7&*?͙;= !R9F'IkfeԆmwbn7>F=N'9j)gۊ. Y/23)w#=* K6I?( ɝi,͸X!44xPu|ރܔl %?#Oۗ`V)T5\T`1l?!ZO4Tos;F1Ff'~ 1z3d };îi;JmxS'36y>yx+Ղz&ZմR-fάv4ھmsc0hCp 4m+J,Q}JסC &$thL-qa#,s-\,6tYd3:G36T*}YCΑD\gwE(x S1 ]:ڬ+yaP$!4^5j[1_K%QFNvqy2wFzh+{m6Yy붉~y,SV}P!OMt?\$TLvb%DyuHT3ƅqV7CقgfQ응{|%ْDWi墑1P9TduZV"hg5 pGjL}M"` =]Ijo]x\DުmTS'B fknO~xQ6#<04n-2bj|鈚ɔEzShf)ϩ G^]-ߜS=KIL(kYS8Eax%q~YKӦ۸H' k٫K o}%TIR8}.~ zB9i葹·FY3/ŒD>kAm h6 XU>a`̈́&ecUrlv|74fAfn&T*{ؒ+.΂4׵\ڳ4䒅R$`C5 <~-k)2Cn$NݟrJh3=E^akq|^ >4 U%RWPk"~5 zJRoau=i>-Ʉ^ {|1v eﺪ}Xg]2g'b)1X2p`tyG{EGCse:1B3م!F1O0TQS1Edw졹ݱKޤ%aDs4`?c~xaspZ o΋[BNW"/I]N2f \;} @\0%SbVB%;>:|xw540e`oqsFL]QbDnWmV?7gciZ̵ǽeƱMOMFKK:8 ly%3$S*`3G-$WhR78!8ȯnWCr0uU6kij#Ӌ~2[-[ d<&M1yiAĄtӶ\Q _B 0hƖܩA+xAi uKǍu  ڇƹ6[=3,Z%0_'][ z"EoOǒ3 8Ll3JN7-xrt_* l,2<&_B߭6FV6Yȉ(7Ych'#'4Eү@%BsOh :jTg:Zyu$\l>u@ZL7:ʶ:˹H4R+Es3⚹Z)0KIlvpOT<5?6!JMiMx?ZZ¨c-hL3*$}9Ԏ"?m dTBG$HJw&mx FƑ թ]űmwp;,=%>]Ŭo͹ MX;;RW@sڗ"0a&o}O9~v$V 0/7 <\9 ֍7D=ƑX0>r"{IFqJmLk9W&#aTqN8l&@ɱyb{|tL|`M=,lCi (Y[BVnB٢'/:!rNH2N` mE%V"P֭CG24NatȮ yG0hwPq*g^(u奞V8٠kVMg1ȏ|nܩ=v`q#KDޗgEU~!9w%m۳.˽dPEe0W.m =\Sw[$:ѓwqy~Q!;vsn9|e\wCG4!2ewVJIg7+.j ũ5JС½Hfz?y=GZ?䔓l!%L;A/-Z[J^D r61^ز? mGe?nW妙PCFNK3ޮBF.~]EV ÄFyW^P:`̨kvՋ)(HWW.7_Tx!M 挈PctZR^sjfX@yĉʛ1]f#Fk.ɾ)Se?WCs2oS<Mpє 1 q6] ݡ7摦l)y2t;%|08ucxj套Ԧ2C;OQ'FKe7cXь`J䫿 +Qs襾HYXpUiJېGal֯@ťjK}Z2KoEG"8<cA+9k>.v&@c^@+_4vJd)a Wl[)ٗ==z6$IZ'->1V `Y/=wj*MKz@s z3ܷEߪ_Gܣ<[GD#ADJ: ZjE§3(#{n>Ym8B?hsoI3lӚ#K'DFi>!un =+:vBξ-#5ϛt̅nBɖƹb͌@ 5 vఙ% 74p}L4^i9*8V3Q >Ȩ0~pit_.IN;oh;sE=/+ED}4k#@Q5%\Vm%kx| [b "0Z7F΋IL+{B{lhजs3W*ISlox!#a>H2_3kRiTLyxWؾ©Sg8d&i"̀~@vV>1(#=c:GP`"jB zK4qm`l"4xvBsy6F w 3\s0V4.5F@i_d'%o:hF(rJ`ćv ϑ!ً| mW)YY9"N_9ව l0:SSgу[2r '!ao:z7Y57hvZn~^vN y9En U;eʉ# e)• 0w@AJɞE@Ri7qrKxLr=:%ATLuֲJÇ7@4N49V-M]Ъ(  7y@޶|CrËkrPk_ Keocݖ~ O+A\9eP 52&1A3Sr+{h+"#P!,'j 1׹_NvEuMѾ͝jaY˂!]v OWvQ&E_Ԓ:̖UEJ\*4gE$xɮvvL &eg5\K6WOAf IaN}p H)~;K,f9ǭ\r*4ap~qsggs0\bh3/a;6I:GPsbw?p[`,y0 8ϭQK( H8|!o6yk|0̂S:⌊,rC{m>kKXDji2Ո{Ky=p)hP_Hb57ߡ pcפ WE96#cϨ)\XW,W s3.n$pDFݢfB/8?OtF÷P"Y1zG7=ըcwhnJ񫡲@|ZCvL oj{WyƤx{+7@1^g_|\uBQyL%(G`Ox4 z[3~@"y]D$W__(E1=ѢTBsOLsnE/!cV-(q 0Б5+!vkTC7ufi ~Q9AdQ0KJw$p v r;YuA^-quXG%N|  J%9-o-ϡ){L<@d)?eV AE<!l(uS V#0t{lR}RFؚB]\}9L!0j88q&3rDȔGe1nkch:*o`/r{&QNI.O亩KR`#}·BXr /i:ΦBZ/$ϓm">e%-KWf˭i (0 ~SQ ʢP۾0!( 寠O#6F%eJVk;c-kQ@dil"#W+sul;:B{l=TQG#(=L9r&; 1{S8 Q-4L4Nja'ߩhtઘr^2ΘW "C:8XfaHqRC I"^|/9 [[2jrx U"/Ӽzcws&m?K6V!QzҠa y%O ]/ρKr6Nʕa2Ez 4@yA4wqٜ-ԭh 4'o^L w'"*Yt%qZB{ADѓR87U4uVx7Xp<Nfoܛ炬46oz6GunISOZK7誚R[,"~f# jQѕX[N4oC֧ߝ/I'!x*S!RI:VCYb6w텳j)gMy9F,1FyW& ]$u|%>Tp&p+Jf|~٨N^3UAkK Kfb#ӞOR),S 6Ra]2Ţ7QMD(^W/ vTf,|C>4ޚe#ն*(1C?4V6>xwJoQZG&WۙBAa+H =#Y(^5 $5˼vQNOl0=|[Hϯf$EڗnP ?!G|K> lcV=V.))֗ly,fŖkIa‹ou 0Ƙŕ`P6kl+nW1|yXeW]Q<>̽DrB)viFmҒkHK,Ȓ-쯎 WIH%>60w6Zqn$M&`WuBBh3`Oh=+.[o D8^C :[lV%kVTwH~)!ABGw*Mي5#!jz#LH̘ӝ`8X]Fc| o0*.X+rY}%dn1"Iot@2d~{Vq_g=sp@RV-|14~$sQ>Ipp@bW"5~.[Y[qRhIٶO gVNLx,%B)P!8|~k:,`D}{dPjߵ{IηF0 [B~-WЯvA8y,W6}&+=7WZ~m}Mv Չ( N<P/ov~?t[4Dh4:Y͍3^/7B܁XFs|w 'jh'ҹ7[m0pjM.Kx^}f{a,ʍS 5hRJ_^v24Ƙl-v٢t&`7؉x򅧪 ƒ"&tGwTnˆU3& 4jWOΑFђ'ܮY@ amm0 sɶM/ݐU9 {\hµ|=,MRj# x<ٮ W1ඳ AZڀOaUoD*فGFIjw{Tbl٣짐IAzhN򋁘֞zG=xA-Q%Vg-jﳗ 'WU^ 7 8nJ@OРz_~#}VaBzvj}0yJkԸ&0.6^$Q;1dPrL VozmՆn ;Ń+T=^t/Kn?3RB6>Vy2;G[4g9YsAnv,*R+ ƿHZZt,N4Kx\-DZ{~fhܜi Q*3Ij7,/y;s*pcE֖EGt%_ƒΰqW5X%p_wSJ5XFK)SD[_67,K WL>}rA\ۤ "P=֧)5Aq=tGl? B$6 5(Vlä?c\Qxʝuijo't:N[vuF $Mx}6'^ՎQEe>MJLifi9'n bU8?8M'aA\/JLW%&{,@EK!2 ܨ%V1{X ~Ӑ2Eӫc]vv]cN 偧Us Q8t\w@\"q/JSzh|i`>mg|XB8b27L o q3}lX;eu>uW=FM{rFARˏyphW~뵧fBN0BbSI[o]HN :#E=|*CӇhH:0fUSf<+^9q^j oIbq_yY8;v k*[ۓRqi#&K;LfCן ^|LHg{1£ɡIqe ER3793Ӊ(=wO/&3ިlvJqޱ& (ĴQ]D#Fgx<ᦻa}ʗ>Fs͊re~].'XU)(_LXazVh 0_xi,\#z,GZ ,2췍=de.I#*i*;3̏gVfdv*v2"ŋX$^>uys%;;hdS{Z_~1 󨺘 r"c`ЈO}pŮ;O#b:~ ~>} ky[n=^ɣPFő =- ]XV/[}PYP}ÐcWɸLH;q#[;d3eZZ{c#!0Lѐmg}Em6C}UyygDX\a*έj@ >BߎpA(O/mQq G*<=&(D*&`>gkY-F0ƒteN۝ļ0ﺗsA^HL.בu}~dkDERPF7ˢ6P_bv&][k?V@ >g1wx7h 7wP˜N%o|Z }sfm\t2s~n_u }q[q#TNnY*@(a(2VBbߖ 3uR]",_ Ӂ=ݼdgDR UKb_3=H% De$jsVpQȘ!owsO~@ XFs{ } !{ TDaY og3gr2 yn*%] s@)rFUe፲|,ppK.IHg^2[sU Pvt^!/]|%8q l8r=1r&K!W H%7L_jfv?FOCҫY֪b3S(;wGM+gXG뵆V!)'Gd n9Qsu~PFx\2S {T5`t¬cDi;rLM ruc+ԶM0g|iZ'O0qDϬ`_*ĩ=n-BvbWT+|9Y0 ǘ(Ww L bUvzZ.`af,ȾVCŋŬ>jfl8$+uߗP˛|8g}Jiʁ"i +7x*sŏ >} XP}'I„r$qM# z6k,Sw]*PdT? iR=D"o CV Fґqdc[<7UHGz_Z%*ЖL g*ᲩƒdRm".uB fiwcϐEMDP4G~Drvk˿Va;gV餻ts@CZE o~ؗ/-=O\$DF[q|`\tt]tah 5祜LY86[`5UdDm!u;]*v6G$B>JeP=̗G`uPy}X0_RjѰj:l![_ۖ;xk |.%v\і2Cqu+K$lГ'.Br` Trx$Q.Mð(0iq qMx;!>G'aqsJ" DêH;3*w { E}v ;J3XM#ڷ)jF0b}qitև",7vexQ_77!r V@C@n^x&nX CgBsU}bTWiU1Yyۖ2bfStݷ6aK_61IVeSfz,b5$g hzYb~x9+ieEڀ?|n|rv_*kMof99 G9MV[ 6ɒ,XH!ޡ~xj5'BEmI*>MWདྷ.KL!)Wpx+V3QK!b N(Ye 8=N~Μɜ!ZeXsdex#fDx wncq52% t'ו˕:>*5j#,$|K 4zGu&?uhW-u9}/!8A|Bd戾 'lQӦQiAEY%k$fiP/T4B @QjYSd%. (bAS:@4,ao ^I;# 4h}_<?M'zi_gx.~K,l@mW,ClU kk?bnN /E] " 4MT(jց#o\3~"qőE@װDifpi-mt55 `wDAp?+v21w%DjC\^h͒)Uvʑa~Z8-3VYr (K]SrNg[3&6Nm εѥTa{z*˗^{߉:u"7I4!n6,flP=Vumuc03NP!4~<Ɔ@+# 7=/*ͅZkdWf㐭!_V8+|3!0_x\>럇U|t aڌP+hRR<#9aǽZdz'KQiOE+W,lH"9}HZŜYR!ņ<^oI0|zU\ga/P]*P\8-2EEcT\+k[6\@EW2[[0XXf&8 B}T9[~tVaQ<r^7ex,KRB,)isbAȚm/ Fʟ2⮎:U)#˝be]DQsz TAxe;hKU-BcWo*{I {gwT@؀䣗H#GTp!!VwY*LMu4Ԋv֧nۤRJH ?㯚XV²iP:q73;=]Y*p4g5Dxfd=ăVw:Lt[IJO/AmLgdAC 2Dz+(Sg4b:H*s0n-!G=p -Sd$2EY}%{js j4Ă#}eT3#خh9No *4`Q?=оEmx.Q}8l]4?5Z v&`Q--KʵWG@C{4aK#,m\;nF w%w@Ux\Ȳ h K};B䙞t$Gy{fҍz58=`B>yG>HN$8QS.ѾɡlnAQZ8`#?:Է1z8T4pd? godQ~#y!w|fb~#*CVo9_k=+{ гK>3gdoƨIo_\Z8{U}0B&"Muj&ze kUSZmLpEJfL3i+?5"_ fn [>#`{:դ+Hl)pM\ ]gjv1é"Owr&qBAfTXyLXX8..~r29MQ_Z^Hm[L Q0-tޅ_l*"ӄd;`ï,л;U ]盞iY8{b$F^RofHIgLd I;_&D t rMHH&6.{]*tMI&́teoLS+-IHzdu,3nG(|)*(zbQȍj? ['6^{sf>xJD$ UC?nDa: q"9VlB):Yw~ғDW$KqRlv WO ;kuMjS.f\>Xg̩x͇D'5)tԎ|qDPo|ũwIZ_Ez8w MH8o-?Qޱ}3Wq^ 噋8WX,̣iM8U`)}ZJ^9;U:K&=Vq')T1iѸo3{nίsh0QB0;]v)ӏ KR*z\R`hh X3YRIFnA.z>( H43ZMmo-5l-k λ(A0#;[@<9pˌj:JQLTIxm0d␷] !Br'VI?=7s'qR*۝ϩT'60Ѕ|F_B2 ^fcg%LCߓy/VA.{>.5~roh$bN4@¿$ 8z,ʰP9r˝ŷfY>Pucow-:8lqY pua?s Uq5ir6XlQ< ~ W\ cf} # *k~L E_,ܫ~-.\.ڳL} D{3c/LcbZ$XcGq`Lze  45BdJʴSb{vć)fegEJ`aj@i_^@@LN$6#=sIi>?`.sWbsyRZҰ':VFԋNuޗr/JҎPZ@-MyX۵Duѱ\u\.A1]w 8{3Յ]{@A#O#E*dpѦv*F, JE)Mί0|&I%}_ }Rwns-A='[7 hS>![-UUD@Q+ժUTص,ur{^d nF ܌ lP-`7M5sZi7#(7;#Q0Kg; Kui9r--||',::vTK;Q6r9a&l7 5+.壉 7{%*O,PX"Z.y/\Yq*l0b@\ I. ZҨ2 zST f (EG-m4uv?0geM9<_$.Z;O {zdo,Š!qI['~x<cmSTX䨐3KQ=:I#<9MCr L6W)䦁 XLH B(baZ|\aOVhx pt37^}jDJrEyws×!5IrZ*ae>sPrdQҒ¾"28\Xj2)`@Dziu:"mo̻x9lDñ5Ϳ{R?~؆RG8o?cf6|oP(O*uw6+w(>ɤEn 9)~* If;%R&3K,4'Xܿ>8]\מҬ쑚1:}@4u] NEC-odq,5JmXS6,x\3n. d!o9.Vz<{"b5{猉G\m(CƏgЧhe^t nܒx`bO akUi#j[?Ձ`&fK7:FlKd:qu_C#ϒT m+ـ$o2tP4,~S\$k:/ևؕHD:j%!>)_eNΥ}P}`Uoh S?^N\rw]/{x]P@)\B01w#i3\qE(}&7qgM)`,Zg@sys@t!0$R2 g-&x}#uOayEu;XxvWDd6pzɻoum۾,o{&Qt[+ Y*Nq\xA --1,Ј~D3s眆 3vla٫H|v^n_ aZSR܅t7`ZiͽÄN8s1'UJh$bwKk?-rsp!F? yZDAg,Y88 ;<>2?VYEg#HmuJ"% w9s< W./l~l-)=pDfwj3.c≷|Ὶ);Z$i-L W?52rmdy+Vې-frݪ8|63x¥>S.(ˊvrKvW?Rʮ @X:[9:glT5m{3]AC|e<Z?//U'~ex^Ȏ\`dkL" ءT ZW#AOva![OAČJhJ"q,[܉,KWm~n,/U*"*XZC<< $,y󶻻SV6^1_ |cd}{DxB I `Ѻ($BrASSs[ qXɛyHaP٣-DUkMa7jktt"Sn'ވ/ D_pϜ|gK"ep4$\߼ǨR[Hј@Ica@Jş avAT=HlhzXh%&T'ʷSmXZG(*+ $3ҏ}G%/.FhVjCXd[F&o'#&^׷oK#E[Wսl[D] Y@҆.i-[u3W.<+8xN(#b Wt私0!R 1+H^>mۚ>@})|% F#yGz DNc}gh$t Y +;rwwJ&)WH/R0CatX]fU7+1h/\oy`K\XczXu|^lSP^ [vx^JY^O^YJORC%0t4I:ߑC]- e\,_ฐOȜdf%~ֈ&XfA)-1Bi-7t!OJ|KYIJ@ҢpFwe-zLR$d0N)<\^_`tE>wLOWHfܧ]7_񃟦n&t?o(`Mabp?gaC{+"n!:QV/ U'".nFm+>u}L: Suˆ%ls 6UCoO=d:->ӈuVAŰg`j?#"6żґN n-XaFx6=9aZ?WF}|,J,ߤ /$a*\3WˢـeD= /vEz@$!E6{LehtlBPJAϺ <5Z.4Fvn2 -ɤ`M8+̈́Obv@w9[>|y&AT[j 5@?3nf4Wҙ ڽ2)7޵^'p%j C>[dē/ -{brG*=&%9!yO|0/G՜io@yP6~PyKE0:Wξg #ԉ B%n 1ATW^_#g {|:ZCn֯nǞkGd%+*60?QI,mU۬Ə"(Aٗ\:2TKϛFקQFfGDW/4(}LMGChA&S]0V3*bvჰO5aar%`AoQzy[rHUƦ 9EXg1Oo]>tD'AT4I;mvy f>PѳZJI%,bwQf+!)g(tx#" #>YUsi$>:?hayOd5+F5f[6욕fF0ntkEy1m {C.{x҉ccn4)Q:Y)vB=eukqզ4U3 Unn,bzjz?2QL!+@HI2xrY8qP޶I,#kטq6g2WGŽW][~$d >ؽ~SZn4B@FƐ-Z/s&P( 8Gwx٥\S4xvCaVcN08 )p!ֽ璈D*VㅔK 9*V vY*)%]=S9>ΌJQ&#KE4z}Q e%ˣpvRB!C{ݒ0t܌HZW,5ߜʕ`a4C2*"*°w#ySGF# :+M 7ՠl>-~;6:e}$s'N;2dYEƎ⵰tӥB?{(5,~)nBԑK=q@SARCB͓L`>vӦY'9??Bӑ<׿æ+ꈰ^%ZY8$ 蚸5;3$FV=={p#RvMJYwh77MtE=  YZ