wpa_supplicant-gui-2.10-150600.7.3.1<>,lf.p9|5oOc =z1\h(!7&I֩ԑ{!j")Q:U\,^X{D.N@Q+$S d#jd}w=Q#'4VM/]W0.hbnQϩ5~X;y/&o;HU; ٽ!EXlbi ĻfTi}ݢoXש*>?d ' J , BNkqx     &0\d(8*9`*: *FGHIXY\(]0^Ebecdefluvwxyz4DHNCwpa_supplicant-gui2.10150600.7.3.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.f.s390zl31 |SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxs390x x큤f,f'01d0bc690945fa8bfc1e86130ce566819ddbcce745a43c399aab466473ad8a5bd57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.3.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(s390-64)@@@@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3e}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)s390zl31 17267464142.10-150600.7.3.12.10-150600.7.3.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:35766/SUSE_SLE-15-SP6_Update/1481ab215a0b1830ea80ceb6538f4766-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5s390x-suse-linuxELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, BuildID[sha1]=00197aea7c66fa2b21573fad7bf56fec8b8b3437, for GNU/Linux 3.2.0, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RRRRRRRR R RR R RRRRRR RֻUN yk utf-8293ad532d9143c66325e9afed0e17885d39f38a2342232872b5b0c672f0a7977? 7zXZ !t/bY]"k%{m{#rD~d tGJf͚tvC n9AdZi胪 )jgn ZF̉U;e\آQ(9І,OXii!Y&G0fʈ#FYZ(1n![fmƲa,3<,l\;Fex^~|_ /X{k H)bUdaX|or74hO&αVp%z϶Jk4I@fV>)c&<gGR!>׍:deqU()oQWfW0A0 :%vl"*2*/;hpCi3uNr3_49e,vE8տn=?$9S{ވcќ'+ UȍKB#~Q'Eb~e\>G܀{#(#h pvЍ'^֎]Y }fn ^,Ϯ\! ; p㟽ФqA"$`aS1p֣f Uߌ0b;Ri8  ]Q tL90עK7i)z7‘O:.$ha((Ud]ǡ4k&)Us}JíoFZG ~D@$ducspÐ7"~ĝ&m`Q.I ӽ&h|;dE޼1ʾ],DdoI.K I|U?*N|(NJEgGDN3"=w fg$I]P8h ߪbUs2*G[A:O}#/5afԲڦj~QSQ%,j%t@= ^ |WDtHh1?}Wgsv87|$2ݑ18of>ڰqNiI@ӎ?,foGUN0coKVQ!_k'0=Mm:zm!|m梙 sQ.qu H0VLJх3VH#!d/H?-۔@56椩N{ mfshĂ:,'4gI5, 'MߊACHSzb)JNS0@q!{f^/n96PÃWq8[Z3^\̊f{K2e8!D| Xw _#+AJ͉MϣISo_8/|7D֫0 x~9HWhtCrt3;ȘF}H.|wE +xZMX'*@&'[lSu1h"_ !K2#<Aq~LYUZtB M !?YnU]Ld6&N-JmEPM$"NZwGlP;G ꏨE1$BO1p1lё j-?Bdr^XӣƎ<%ktr1WH,U,@%ÞJj6 eqg.@AӔ˜-CU"b3٫(!G*;󟂤B*{<~%b[/Fn(2(yJ?VR> J+N.Zz}FSlv=hiՈ[s d6YN͑չOEuḵY<=0=!heD ƹ*LO {Ze(WWV'ƞ ^ܘ^'Tsզ 6WҖV0Mzot6՗bYRG5w{h~9KnXD^ I_WS%T|0Z2 ܶROht褪Bk! -JЌiyh2E,w!򱊫`k_:n6-cl&GqN}N-3W 7-"/8M֨Pu1I1h(rܙ= o%ݺ1׺fBbr ڧuZ2R=@@W3]Mʋ r.PQ|w LVJΠ|s&MKD-HP#^ 5 nT+3P*@zs۟Epÿ咱)ڴ&9fwB' /h|5hGV7OX#Nyi[E"㊹+Ì#mD=c1)*uL%ׅ {wP?$R9e+Æ~H݀%7kHfħd OȬj3gSMdI,E7γW^; C}1H' Zf*ʗuLD DހH C)ܝ 7HSL+᜿`{Ɔ@D֞eSHf  w!c2xTlpK ?^;O̕+b 7U5<֜3=ĠLM^e=0\*A A*aW2IV8Altm О)ꁈ9U 1;jhAN^` :e?jXh hLW7Ywq({/3MҖ?6"P Cׇ+n٘'WDw :LVcKVw0lbjGcQH%z l.Iqr|EZai6"߂W>@0N ǐt {pOMx&3b#Su)€9/Lɭ7f>ssz̪x"C| BM L믮f}܊/39 $7CKM(+?5MKK.Rl7}.hN0Lɏh3y꺕3ROBk3I9z%zd6y6, *^O;cS{<,ǹ K5@4^ǰnfMT[(ibEީz !K{(vNKXh=ʚ[mpyjlafc.:V[ovqAXr}W;+Q{ _GEd/OJZr٧1% yT[}T?>NX,wUϷ&yY 1jw>^%Ձ8P*clW g ՝_Kߕ>Erj3Viε 񄮋}kE6FH§fZmR,f^N{ \ޯFs@*T:YTT fdR{X?D]p}ӟ~NP3M!*u,IZ6l-[ꑺ_$ʾ吡6DRJ2Hto}{;V \WY-oO]+s@-|Y#%15q%(GG/6Tj2O=d\c1#L اX!or3E֑%.d֫8n$xZoĭZz*w( =$ &H_ۋr63>Z](gF?{g#UD~-Uw[UӚ3wdLs?̂o)42)m'_uZt$&P ]K*DV5OA҇%jP9AoW$&p<,d۳~ 2—&o__71M$҈iZ"&vma)΃T]ʮ꒤VPj}`Ӌ&AJ֖$9gh0IPI #;}>jPQ șWӆ ń+%sSN0 V0MYor|m8nrXl 2vь=n|$r~cXu 4Q@Mw=xNFW'<'6[L:!Bғu83pg³bjqCa(0^<\*o\`w"Z\Ʀ#J}LRsI3Ra{kJ򀘕'OVÀ`dDr&IF)}JΑ\Qyx|5آ;;|^z<)33y;͌>"UF2ZB9B)ѕ-`o~]lI$d?h.:)|v~5K/+b9cNnAE.F,R{/BofBaez4,1T} ^&}؅.%pیXs @Z%k.䘪}tϠ_c*VpN1&GhUJm[6murJH8Ŷ-t!b6vAEaL(Ec6F{C,~RJhQ5ŶFYӪ(3R*Y9NAoSp(u*#ՔWzES_)ͥns'Sţ1gz}Y1@7D(&<*{^|K1PlTLnԱZ햎|& tNJk%ɋ>_ɫ,+4ynVT/f}ְ7V/^iV-ߦ1Q-|#/znZ)N ^?r1L[" eUOFƌY> +m}XXp4ַb'q-"%k|FHbaSv6P(o9u-%)4c}:>5,,#ljzQ lsA#~gbp~NzY(S2"3-W n)u p `W~}&3a5!Qkt>A+k;13ꗫ\bC?WoO=PF;3_KJ2WFl8P:PFurӍ3l פr>!Mu$hgP:0=Đ "GuXލxO$A-4gxp;35D|fVθfA-AaP,*%.Fj/Oe a.V7/BNJ_?NÒU$ x+N{ Z\@ѨH>(ȣP`TTtp=`l9FFH8ʖVS]D3)PlqC 먰$~jсwi Zgzl^S+If|SWѳtNޫ޲6x'$Q`:AX 5md3?l,ȭܾU%w`R]`GPѺdzl\V>?G4G3;sl0}v0}B^5$B1RQS ' 1 Tֺg8VeCʀi[N'Gr  ]B-ٹrՎ52[BݷꔿϬo{ MJt@\UzJ*AJX&ݦ kBWi<>^*8pa&& 7L xwƗ'BފmS9s:#׽G6R00+)j DTL gH~4Z+=lS ? Dek@q@V܅+7)7Pz7 emh`Ds#ٙ7~[~{.à Gihΰ=𥊬0a?-e-7/$<6 =ŏEKgo0M9%xU'nΣ[yzp0mtIu/&^%XKjCEӠA7ʖs},cZbb]\SR Te< |dd} ܇E݌>wg&AD=Bl$^ךw=KJm`ܞd\Yl;vXhfHi34(`9Sa/;W Qi3Rl„LiAb>ݯh AN[ Tnhqú>о֭ vХjX0ž45Ben;x~`%?MJ 0ضN/Bb]Z!@! õsl>F,J:=  SW7+>Dڪ 7N|'4$n9`΄NScI+XO#rBnnCbE)'%N)uSbZ cf ԟ`6Q|[ͅ s#S%%>Npl1ɬ%ElWQV(cpyOYC PnheOW`N[R(JvRy#j\WIm8]2J@(KLJdIKNjneTvdíTi XOV cp=>ʱ5p\=xjY/[m t1=Fl ]uڴhx% }fPb3{BvꎵB.^-3uef][&  k幸ݺ:{SAK?8mԶWv3"7s)628/Y\# оrkyZzC}4eb)`W^xM%pEÎgіB5g̈'È"x!o ,?nAtiMn);#Gdo"/vh9;sXH,[ĸd`!Y12UmRkz[&K]y;{^Qan;;aW ZA }M9y|(~}:%Ϛ1Q3xvd,R4CX~K^sVQJM 2jDcK!xfd"`f'AN%O,QU6zo^47~ҝ F:ydmwñ[D:;0 A}Хn01Uoʽ>xb|.j XO(N]yh gE_dٸ[y_,֦O~ȑ>MGyF~ryї3s,TوScZe =z?4yn4%]cw`r* ϝ7O.Y$6iŜ tϦ&_SIJbgTEw.ƣS*Ҥ/m^9ϒLX)!li>Mz՞؇YͶȶEH0d*8Ƿ+~˥x x\v9XmYLg|{q:eum;:US@R1g易Z:0KҐ9W\2C@/c?^^S}/+$+'|?em:"}@JTp׎EwZD>JY ӗН _<4{y^}@Dd,$P]N]L$W !k4 ΅빳~IM<֛y-0/p*LUvTQ~:\[@ލ]c+x]釭Wd{Ѕh6*tr'J>_2 ϡtLuc/^\; 8Q !BVG7ioЉ?9.݌[30ۛPUm[WDcVl} 42z Miy<1ǡ0iP໻09C")Ez'T콊#H¯I*}#F<ly"\z u]nO,bNw7`(WPuɺ@ּhb4S\.iHJsϊ{^AX$ dSM4i+fr632{?# "5o,%lN\y$Y3!R|ҙc":*;zom3iaV6>#IPg~ lN hPm5We-z6f\UҘs{7ǫZZ<,|Xq? /c1tsH'ߦF.+IM[8$(!sM'O}gBm5ah :=y(#~>##C1L(b{[C='xf*qn3Oq~Gw8י"11c;omّ@8AQt]ZYx$ﱟI$@LKG3&z:,IZB2 1+,ijx\{K>.΍hN\ϧ` aLT0gp8Hvs"]Pp\ ! 6[@"#7 ^X_RoI+,C>Fcr}Q; \F̜.kh3A*i:X41AR,Ϸ b)h,YD@Uz933VffTSmSv[eL2`> #ǵS{ bd Kfynbf!ƊNz+@frge|>"[m;mdji%|9B,<(r:Pg*:.UGdr%zZ*%ORP"mӌ[e-ґ TX !k6~% j. \*N,brbSup4/q?V8F7_&2$81f'Zhip,qH߈>e, ;3Y]9EGe5ژ  ]j\>D A6Єe`zD˜iɣA\|z$C'غLADh*0K:=_{{;b}VUud |+%򑣇8%_I6<vQ!9[kޮ&rDlV|Yrئt0tfJšv;5vNz&O)G)ST${.js&Y?f3U&M39qBwfߟe"OlMOrnĆ/iXɟP{q|rr%_V`fg/qBdwstAδf| 1aXhMaϫ[![j!9;}0Y Y0୧bl @[=`[~@w=Pb!ȷfosZ<&ׯNؒ32MQ}e&.%ZL fU _~xxpF&ՠ}|p-I-XCpD;]:raj@ \_-IR6MuLf$=";G!B!4x,n\~ s6a՛/$sE3 [ҰLU^ BqDX}k=DgѰVbWm+-Bb#Vjwe OC 1+;CSmnU'puYpIG} (<^J079ǐ)* ZGJO^O(kh]]uMoUp>_ U3&{f&xM?Rg>f20%YzYp64` = I~%dbV`[mdxmćFg]I7r؅ Xll 9ޥ5X@](b_߾D* &ʃz~3"Xhc$#m'=dfh~+D h\T Fb!t]"c@؎KPϿePI EucKtdVGnR?Y.klGʃ.HPо^an1 2!MK 7||txzLgeH?+(rk.ўyuR\uXRP! MCHwZZ7箖Xhl뭡GݖA\E[!9u3kB1؄ʑxdӴ0Y_(9I ` 6- 7[Q Ȃ SK!օ2#u:-R J-Tݑ<u gwfOK>M XIæʇ4.pER 8W&^WTJ|[jӟ1=fuCQ eǪH L1}Y#I>##P=b2Mgoku!g<3-TqY&Qͥ9 *[0=O]wi`#\}kw!{e] ,[hAX"BwO{Jm#d+i-f%VI)c@MhE=ZYb@dUhVcۺdy=J9u K\_h&YBa=;p2]~l|;l̈́}aOMF׮^߄\i& ; 2Ź>.g+˪x AyoTȍo|R-Ŀ/}5N\=v͘mytI |;FP%PU{[r-ڋ\ϱU?pIAFyw<:uz~.2rίvKg)1]@ЧMG$Ȯ{I|T˞+W ɜŸOΥ衬NW2 _Vh=Sb +2էRrhV w" DaާDc:΀?45pvy\IfZ883ݞIab877X攓b) ܍hKFNGhx ۑz6l,d6mm\Ϣ>bj$ F]^/ހ}F,=0NuCԨ^^vtmn"}N8+񏯒qU-ix@O X)]Z8^!\V,#=1nRе!Fy[5"XZWܤ ~7j1LcRj/&@ $x[7]RnVߋSR<5AjTd\L ^daYhS긂-v,Q[ l6]{w >Ӂ* k9SG{V qBC16$yF@?^ ?P :.$?_zo\?ӋkugyGÓ1G^7u&R5:ʤ2|5V&n Urjٚt斣7_&뱩k8BiܬAl7CF-F3@Lcw0OmoNm=IA"e UnlNCR10(3̴M[r1Dz:]vydvvb5{OŲف6/=!Yc~}sP;5 ](<<\CՠF J&H!xf_od#$O!Y݁oأru m)ze4qtmyM;³WQj-![2I92g ϽZM}tM& &Jar:`2pCsebwAiGT$A"E&0[#~A:?Xca@%ZhId :8ZpNH{FjەSu$2Va<AKHg  e'bHM*aukؘwʂq:yVIAoޞ")̹ }'gH ͻ#9_QHG 0f*b]I'.g[ Kd4@ b\M"<"$wU8PL@xGѩ<ΦƇ<ϋ'/V1xIA%kqA0ڡ,<Ϭg#&UHUQ 黓VAȎl33],S`RDDh rҶE& }".1 =Q(]C?pv˄D\|`E/Gz[9 i~ rUMi}KXE2{ul|id12i{u+E9J^r!]szVa\bV5u yn/ح{X(t7TL+>7I)YР+G5r vtwpNE Jʆ{q9n˾qCb\HO!=Jg%O)+y sEITȵYX# 7Wc|9àn 0^\Oa^omʘO5-^2I#m#6g92p'<-D<푅4$L FyH2MOO,>]V&xTX yr偈r2?2.vv XG]OTJ&w ИB!F#T6%L3)ĐR)m3~ LnjY Ñ2|#NYy͗]cgɵŽ[DC_hFs\'Ă _$sf('<_w$BʱoT1lY| D$,P5:ipr)yX5%bGQnbzc!o,2u#_ WM5Soȸ( ;۲2'a+5O4nlɩT0VfI+7=I(ցu4N>1!T&e/xGZ7IFo?OtЩt~5>.TxLNizNPaC=X(t8A^룠g CƧ:4S162c^t#v< ;h Fz˥hvxH~Xj _"ɫiWPr1ʭ\caWݷ8yw5Հ@8T"$N+P]fyCn*,T38TR"ѵ̸:|18߼h5+z80GZÐFX~ErԟrH~J^nvn{Huq+Qlb5jɑ޴f\|mT$򟦈%_X&n}8 YBPIn=:;bu8\Q;bVW]d3_>/TöxQ++띫b9Am/3w͝ÿ />TԝO$&>agp>l\;+W9;pW+VM g/Ut{{ܴVY0fQE:+i9UCMbeR&x^JȈ y9i ['|nZBh*}=*cqjwJ-_3xvNKR*!+Rz + :->K CoR8: :n>7zXNg9~rdfQ" &Vkh?p|t+㄂dy9 BL?$Xpwe՜q]>5Ʌ{RϓV8|dB vx+x2; ,;&D`ooIԅrv'faq|/QN)}V+'sH"@Iηz<oد90 ]AP'תVpҘg.68EbqL]Z ^ *YLg~KFN1:Z&~hbv*`s l{6Uc"P~aX8,  T`zSmZZi %n<XzTޟ7 1ȾJqCm+kf)*1L0M37@ɅZ3_;3pMnon(ed]jmCgM.-jcmA(Z0Ǯqq|RuA3X(Rafs`4C 1x~njP7U t} RU 5+@AY1RD0wlf"ult;<%=qiv\Z5]=kzڸ\p_4-6B "=Iڒ#U_%>&NQKwˎ$S +\E,zElIH]֔8ђi+?>58E;:7fbt W7y)7UQSFO1v2"hHhHtHDidDp/ҲVG(WKͅ|˺KDY է.J޶Xtqv)T~seGg]$O\"k6zi)Lif{lCi-ziA8]U0T^Y޷bxoDq9>Aqlp矟T.TGƓNb3 nkf#<1Vח'#vH8a29jmYUrqd_/9 |s_iSB: 40_7Ye,y>#c6#6^eU o!7TL93}Ql(曜+8T_s쫶^TmGަz磊E3FzjrvEU (tCW"2,a ^p4h!]#ډI8[F&Y #XSU$guCtd調LU3#C3AwNv "w5&EttAx0JuW̄U-)1Gh*Ril2͂oVa$RpG4;X7jlYb&&U'+{| (X>7w>tqN66+Ծـ֫%76yJ鳉2HDϒ`<+2 e!s# "[*򛠋U%DV)|ӝ,?*GU<8U9ܰ,ChK_Ø R(XŌԼ)z82zPLد$cQ$?v猧@l=9FkV3jxmNϒ%/MAb֗W< 9$Vܠ|ʜWXPt"6ut[HT|KNV퍨 oPXtvia "`2t2_ywVs1ug[ײkS{O\r'^-,ɿ-^qȤ_SF6f{͟ xcC+cL {NRfD"&_G E .JSOm>\nt5CGRMڏ\(Zi#Q> LN'cADge"-;dQhmƚ\DUEM4 ZdNBibSP(;w86llZJ]swjĈBvx/%E$$К ZƬGth&?2dA_n]:\C,Tɶ#v=)obB4CjƓ^VϨj`NPߠ(_=a!%D-]y\Ⲇzɉ$r_ 4uzu/IC=qn)FPHw^G%QÊc28&JG~U“|[trH M>3lގ,w_;U11쥴 +{=֊gً[j{d٧%; M+meF- UTxF/vw IC/8NQUF36OoxO<õҌp;gf3YFE`ҟۏ D>ܢ@w%cm;T|%Tt $-pr'aNw=[4nM<[t"Y! \wC}E(WXY tiVA#j\dfAzZ"mp|亇FR)gʮ(=A讋ёkm*1Ja3? f.͎a6-^$bF^̤F} !`'*f`w + TTNRj:RU?~tꈊ!v<^;CtmG}U{a%+s­F{fg7vL+:O(ӍEtyZ \ay؝GL"i} |jTU|RR|J_v* ( !]M,{$cHaoAK'!5HW{?Xb-$O5Ln`Sp{ zh 9} ,c=tmtZ"Ҋq+YMr\zq"?ѽҤ){UviGC(Jj" >('d!,Ѐ#ɘ3?fi/@֯> !GԆdH(#+k*X~mbGl$D!Xz5t/H\^nnn3b5WK5rJT+W\.8Ead."eE"~[XU'¸i&\V~GN]'D/"7[ZOnْ.$3< swC=.E ƬO?&nJ-Lu)4˽Khp}9B"ύ~#3Ƹ˰lc;IwsJay?fQEn 3ɔ1oL^Z 38U4^Ő6;NEn9FNuE,nF+}W]qM'|Ov`irUV\!DWRdAWL9v%:*❅PHK~J:$!JDxt> A%s(sklp)TPv㰮X*6wJAXv,ci #9rmhnW#ʄ55YS&^wD׸zN)vgLc)ݾ ,q ƥY}HTeH9* ȷoPTcvJz pnڿFmF%JHRKm@- o m iްGe[+ zxrR 2b*Zwc1vO.xcJ~Xa\SY"C1vZaҐrF} ]/byCGvJphG3L::W떽S^]WY&@DE hȟts Af ,0tad"xCGo{ 9dDMg32B(> "Jmjhz"u`*+hlmΠ soS+ X"KJX1#ļ +>ӝIxͿ"kQqi~L?;OTF/hr-&df]md}H٢} BөC*N3f,,;9czDlB Ɗ_B,W}9O9Myiϳ#jxmi #XE/ L}v&B@w(溷JՋUx_{'`vL>n+'ГIHbS]JuQbV_;FWۡX}w=^׭ CN3ido/ j)4(4iAa?4?D\@O[mh28V/>=mW$l=oCVrH^Yh6J"`1OvȲ4Miӥ!84> =S`HiW9ʬ?n'~-ր7 k1F} d8yNYt4b=o.g>(1[lm,IwXvB$!w#-xYm>-@2nP_ rOz)̋~Z@}UBvR&$:9o!B`/vye58yg)BQAm(3 @Y'8!ۗӚRv~n40j(mqH3CxwQSBa-8yT*vۇ f{adJq3ih,t[VRFpU.q4ҭ.^>nwn2n󐬘Hj9I @fJ&1}`,nTBށ%GLޖM5VcNiȰ!OmQ&CX3_IDdN+MBB~B*(vBn ݁!L2vl?Ydf'bS !( F+&ê aF ~V5 :R#0pPUiJlׇX ;%;OYjb+X޿M'[-%9'lN$_M'0э;lr!ȭX 3l ];):UFo`+> aX(I@DWAmg.K=ƒRdW G,|!I)̰W';Dь- >3gfʍޝQG= ;[;lJ^ <Nч{N! }_dUD[ 7Pi!rN7qDb!ްq ̮x!f ̟q`i?6îUJ6-ޤEqͬWƏ zuJUL=fOaMtwT-Q>'`]~55`QПSc%#wh0` "%KTAcqE$8^J6ݧ7]ڗ 3_#*D(!ͣ虯rC7 o0mR 4Z`Z$UglFb[- ؀wZTD%QinB3,v?iNeIr.V혂"'s:AJ/7REĬ)[o5lm2TG\W塍N|-)B zY:z`x NJN+"SC>s6fwqHN}ym-ٷ`~x{#[ygYh2; E7Z)i>MILF R(rs*~5zJ?`=mԑ&ˁLV@!N&{$3(--YToNn64G`ⰵ>&gOu:6O&^9;3y_F, #zL%lI3 SPyJE=Bk,"]Z]{ ֮֒Uzy=V :@Gv3bE7W>F|㦟镧;)pW% v\E+[li' T6 hѼYzF$z|p Y@gpYQHZzEvv-nəoYa<0B\0ce*xCˆ‡0Vc dt3.'!E{x5E8I Vbq޼sQu.ٻ3 C%s3YtKkopφ Q/t^tFI-S:d!{jp>x޲d;FY7oxPN>G{ *vFSb("v@g[P,)ש\Zgg$ʹʸB<[i r`Ve.x^og1}Gmp-;&yextb ܒ h[oc 7Y$.t󄷑!QH"hSGMhWBRA42= W;JPn'Y*,( dS#iqҧnzq;/ӉU=3at25-{w-y'.#.EFGil2kVI9tM[|*&&{C HOA=cJ6`$*˴uhCߴ75W  uTÅ@fI>rX\($VO|-3N<<Zx9{*Iɺ&e єSRIXyn_Gi=7bA厊sQ-t#ێ/&q Djt|;V0s 99p]}q5P?bl}US1;jbN[[c'6;19cAPTT Fd<1dh$fvky bm,5(fl#ܰA{r`l&f&eng$Ivԙ@k*]ƈTǵƂ N)0'ofi!f̵'`b/Y7G'4ѰIǀ`gXBTp@7CؓO 6~1s]sTɰL\.KQ9+8ߪ6ov_88':DN8)) UpF8g?{9%\"P*/Cm5/> 8n.+h*HYt |IJ6ͻ]%bfw#?2yW ] T~KW)U*NH0mRO DlmNܸq.xs(h dĎ;vچ<6;GH ؽH#'ZTJ0%ĩb=1jD\L-~=gk|g/`y6^R|'/^ԍO82^'D(+^ *kf$mTf2^DF'I\MHL/ 1n9mkM]K|saLcZ]wat\&јW^+d1}[ސƍj;̺c\%AmEKRZGZc Pdv{ql+'7j?N0g{LNNު)Y"7:6 >&x|9ND!)q.F)(z'"^p!u~%-bД2󓏸wHl9"/ ajo8~d#OA.(mW񉭚Ò#Fu:k\=sxF=ݐ6>2[ ī6_'ŕQ]xCyZ EL=NjQ>Z+q3]1ߔ'\9]% 69#!d֩f`mȴ:4 Q4B҄ge8Mjc&ᔋԸD6o8_ z^Q _=3'R{ #[Wa5?VctK0Oq0j5R$fYLJx}^xb?$)tpBM!WgR%EwpX]lKUoGCf03jPy-( óˡv˾U.|. uXN"H&HUlDfŰ1b"eb ư~ !x;QTB8OK ~bΊZyJ*#+bl=URALݶT3m~7 'mJ*+ezwH'kYhm/auț(@/o).9^Fd) "tG4> hk(A_Y,kLY*ut`mn?i> fP=mALsݙK!;ysM^|HpUSkMvJd巭W@ jE$(y37_k=#dgRCGז MlAAU:sAI)xϚ7^2l`uOGgEhSaSZw$V9|S/(4 md4ԇ=:Um=vr9h!fh]i>:'Yx{C:b`"2a!qnoo$8 i4Fqݡ‘$c==+nIv]H5`w1OxܔSKa^utkݸءw_ǰʪ5Wqns}%?ȶWǏgZZnOW$y th6[PYD6&*Pm]P%f%*+!y PpB3[rX1JME༭/)#S6ju'YWa`7/6ϬU>0;sNt=K' 9s8͕9(t/dYx5ֱ1W) D8;מO%L RwzgCisG1O-i xu%LN-7Vusʟni/[_1ޣm*nkWCdrj[')"CBFViy0UK'V =wڴT5AyoMty*^/ɃbD&3"?s :,WƑ pNNK`5AD?/hC4٥]s2QTRnhۯ:œ^rKmޫ6x*E./`Bt*MPŬSoϑ wk8XQQAl9ؠKocf{.]ן7Իc{ņ~{ N+NƏcSH\bs<,Qg~w VXec|Nx{nWj ~NjpUdI%z# v;H셻Hk'd:'\FWwkuba[}kfs"w,.pxQe]xds~~Nƶ$r . b h.c0<@2R0ɲEps% c$ø)'Fh1P4Oi/6/j *(/ l5V}Ka a#*%bOpz=G+aTT4tC܍y\0t|[:l3D)uf04"luo^VI6 3;ȧs'sG,xmv>mo ߅kLYM̦G,j3[Q,k/df}jңm?Kd+oE ʲ"At$O? YGUjet o. ;z5M = z#nAOyZΚ;ɐ:+gC jK{2XdV o\dfQ62͚#~ ,Rpô+$1_{Cz)(xG~b3ssCk0-@KP|I>-B ܥJ k+8c1!9(kS5h&HlJ0O}!ĈgXvUK?L)NK}GZ$]n}$/)pPB=2*CێZ,gj7}YbbbD/;S_VelKvMvʤAœBiq?E6P U&thi6GŽP"~K(&ޝ]U)<)5^j@*ĞJ(p?Ӓ&Q \@.j`hWH}Z!QHӷ&ڣ7Z2mo6e%uhc*~+#pECfŒ:gOD ϗXm-#G4A"5vtivq+IldXV14ZU;M|A~B`.Vqß,gF(Pñç*VONyv.ӏן_oԥxQZ93;GnUz%A05r)5>e!~aҙ%vXKOa=2}E߸!F1־1S ұ³ `9:iOaAo }"vEEX*#,PjEhb ox{ ծݱUC8^.P&Th™c3OF=^p"t'wNI ҙAӋD?ur|AEՖ-IKzӧZ)0 椐񄑪#9fA5x5`֊CƐJ "Z6M\Ruxiq*QBTˈkkdnd}<$3B(pi`յ/d:`dqt+s50NLqSO[ 8A99D v'%[L'S+W*cw}rjsE FӃ"[*~ASGo<S/&Ŭ\yOCv&ݍ8cSw^ u~GXkn" eS mG~{w"Ί;c`s^i̦/4- FћYޡvd GTK9¯"BT' 1*WѣJ覯YpvV!3~X~ \;̙&^<0| GPS'"7K:Q-SYRs!vzJN-'!=C](;bN=BQ9abkhihykOzB[ysp;N5.R$W kO 8ZvuPR+D,yrӐC=\yt7ⶱv[ŶkekPcF<: ciOO=Dro}jF{IpmWݠ?ûUkWkXʡϟN&, 4sNÛT0.WM&4d $׸e>i -2x'i#nD:cC0ob,"9 yw.!a1r "};?\NOu3d$^iaW;`߿@~>$${ilF+TWyz,̸AEtmu̱\<&M: M|p#^s\5"&rJ[9J yeY d ͱ;/𹁳;ZzF^@[+/PX$Qb>j_DJocv\fI6> TҥՉۅ3ݠ)I/ƅUk_*u/k-ɳ^CjDw)H.AK~CLM <.+PRevX #.S oklv*spkCDC%T M=i{:J2+8x;85jx뮔ִͫ4`'.v$bXsHhlf;O/͗&aAGe/|Npz RZW4΍C^EƁv- nǫtUjeKG,af%[0@џ講@7SM#R;%&j-rUԆ( CE*p`-6~|d5``(|;3&-̦3`pIS/~]otBjEƮ+Crᖍn_OGyWGpBep|G&صeUcAdp,dDՌZwI#oY7|-FџE6C7`b+&mΩcV b01@y}fUpo_g,3Q=֧!o܉ / ܭ9r!̔V>&DR1]5NǤt6W>k35WJMު_L׮|Fh2j)x &R;wWtlHXѾΔGѳ"°aG^n2C{jڤ4.D/iI=-..ǐ ҤÞNKUBeUk 2lJ̮ D I68=2ROlW"p^N_`nDNIEYtA"c@'4@N6ָУB)4hfmS۽3wȁ_Ys];phM>Cr5L l>KV3U%QgMkX[SJ6іUΗ0+<3KIG œoNw YS kKU@h_R1R* x֌hzK-:"7s7> fȔ+>2Z U}{֕d]Lb7fwLU:T2ՐP--1G N%+S,"b`̚o $w~^1 |n()V2)+ #+֔1P.s,b'ReKA{m{DT#{w|b#sUl )U~~{1mлoOGVygHyLd>ӣS͡Cx&R)<,o#\o*=7s~3`"HxSy4DׇƬvq7ާ>7ËApH/ȑC·0I%'o2 Pl̽'?.B]}&9D9[dFEL/RZQ[ I\bb!(zܩ4C ^.H֘({a6¤.Ά:M:;+)x3?-Ls4%-5'y2}< e]!ݱR}z!00w\^?w!9Uko<S/JFSkk'QI@% @lf6Es@*qm)V|` ^6]z TU~)!oBh'VЦ1ZWGF2| pk:GhoEӯmp$FXC*>vKTEm(:A_&)! \W& S sA"Er(3W깕ʉ \W2"ʃ(EůhaoVT z_E²}4)QUdp> V aPfPޏֿ 8ݷpú6ńO|I `:Bp𿮻ٺ]l޸ v`>k^wL7S:m\Is"smf׃XmkJ+/|b&HG3> iq;A}ϷoiE5}[Ϻ<{w hn3Zj4^{y\e_ZWPhv_'GKsD+wӜhp7#s 5Pa76dM1=jS|SdQP*^`9s"=iTٓ+^=]{ ݓYyCÑ#jcKvHGE t16SuqLvö>I,#h7Heaw аrOn( z_]8 l q1#Mtκ6~/@*%SL/Ȑ?\6|/U,Ft==I@BvT KU\6CŘKB$3Bhx3 !Jy^!eoS !ژ˨ gέ-{qV v|@ᛎdگYG_ םMÜh 쬤閯F=!I~hL`ޢ'p"\vqV rpf䗱]eXX "ΩmJ>Do9G Bp* #Է`'Mz@7'z,' T1ڗ%8"ge3Ѝ;۴n.tnvR>ObzW֡Dh V?D KC )nfD cS@KA83f+6_OGf};cF7yts$@!CJZ\{^^pj?^vPod5nSKn7BdްogկBAA]R:?8}</ŏ2d·xS~?S6.  G{ex"8kt'W5"=3u51;Nt e%f[9hi`̖L-8(엇n00I^Sj+ac=ӼCI &ƅ!뎊+?|jX#4i)kgj)> % j?WUgVX#//h׭~3G [giA*T[7++t ;aL!KpQ*-_8/bircaI49\p_ژFE~OCm$Z Gw FQrQYԠmO}&'76ʋ̲Ņ,OzQ 6eij^›2T襤xQpELн0HȽLdU ;wtSG*if yΚ5)+.ېobrI]h\HB{dyq{OyLat״ ˽.$%l!jo4u@U<'NB$TࡣvҲq$ -?G\ocyw@J:s\؀&pe3$c|ŗ__"CQ)d>Ia_Z$A|2MzR|%^=(, R : vH]lIpLXOR乒Z(cvMԑuV^UzNlh#>МWUz;ˁ8% `iS2wAÿDok[#jd\ LTjơ=)NT'#e;e J|(՞ZgR ~ ESo XZh"|iBI37 RUBkoyCYJkλg6X`eYuUoļL `]1=b-+j}7t]I͜f=fdАFRLB;d|Orq3Bɀs{}V9pvpRR~# G_e?TP" sV4jQp*qR>jq U*BF^61\=Z񘓟1  >&j(&:)fD"9^ȧxCKALA6D/ 17V˜~PqRZhjD#-{ټnGk XR$sjЄ`lBR| M&uy &+ zw~+顃7&ߵwqAeXnP$4 _2\UKDWa:= cST kwXqeFCFs@kO h _!cow+!U_"qvw[+ wOfY"+4>wyg)DwS>%.NU70{',NF .Vg`s&|;SIJNע]z IŃ'idDr&F8,Fs{C7jnb OGUa½\ī Y@s@Z1 :oߏL%cNE |G+p*o%.C[M]Qpj.,h 0*WLp󧈈wUWGa;MX~^E+KGJp9@)Fʠ9mZ{c*Rb_7y/?٬s*w7G5</.3Ms:_dSg#_0zHs|¬DK)X$r>\9'uL :{:p>6ob@ Tv=9 bCq2 3S Z$HsSE,BY5׀ սH%N毭~te3RO1)=M>N">PaWhfB/^"` gM קD˚ˢ[-cU_ErԮj Ռ3Q@ +/mtK)]1*6 fweʥ.!G(}g ~Lt>|sf#A}zʹMKF|}#Eg(TM1s^OH"wT\Uf(Rg%x5`H=ó=~Y襁YLq*/Q S[s0qe] v\ŎEͧ _gXWG}y8F:P=l*7el7:i ef80yܐF I43QX" ]z~) Es@bҭ׶X5P/f ! ʋmں=>4S(bUnxOfQ,g}gB3`F%VӈPnZٸr`Xs!Vnq YrPN7 s ,jzjqiL <$fnm' ]GhQ_,zv29q860ҡ|M^t3`AxKv[.v~^rtl*(aÁg~)ˤ[\|]* BSTKW>&H"$E[jgqXތI Jhy WfV'鸹dtU<™XҤ-^CLn)Ñ-<bDԯ/`q5 20j. p1jvyzMެلxY )y,SȥU{SM>9ѝJפs<1ϳvE]o-D>5͊2?mn;Fu]Z ]bB|__8yzYĒ n5}hɘqdIJӢf4-+?+F%6_l沎PhFd*]W5a{]8-0j[39whORZf;e!Vjv|1XrþLux4BY1ra5!6j؈>#7׶X,r!+ی,.ٱkt!Jt]6-b6f9p#i2P @QnEIMeW0Kr,ԵHlb=ĠHwiGag!DL  :T.0 mlë̼ Ԋ1[$ț$r K1 % 8T>+n`n'ž[Uie7]'oC[fiPZv㧡 3wYd]h|2zBnWC{Q$%ybMLLhC*@Yi*_x^̇+F.MͿ~ӓ2l b=﹔"tQcDP';1ljn~ʯ َ,U:!O|\b47 -qMN0H`H$rpD1ƯVʎ 7"xF]=Ns&@&D>uN(ugV΢dg ]ؔid|b0iGw {^d(sӠƗ9̙2"51%m'v#Qh;rJCMrZwڄ9DsH`WP}Z]VuUV\^gޡV?6l0CgpڠTMkwo-+{Z V R#]fs'g9jD8<(ͣiٗ5(@*0 6T"GKٗBjAӨ@ݦvs`]Tef \hgbf_3_a"ݳ7C1s 9KRh\^tnn?7v{hx b ҙ35Jg.:+2 iT\n D1r ?u1yYqQ!G\dxĻ EjkMn-c4ddjT%1pcV` n9iF;^M\x.S@IyZ{_=GxR vNŞywE^&F噑+`(l\ 㕢#9[azW($4<cL^-:D<ŢE{Z[ )B}5B1 -S`0mJ:RPf".qW":R` &5Kn/DɮLjek 7?`-4}f鷮* O;V0YxNBq+H^ JuJ/NJtAE)M:"bK{Ā=9C%ޞpL]R״>OԂmxzjNq@NدZi;1r4Gj-ֽc/d&7 7,]`a1sNnHM>@ZHpߡ{2P"lNWL֦ŬILZ] `6΅Fa߸gpb4E%{ dQ+d\-]n׺@?b C{W,űI⁁EQ6y9`̞42K~T{YѪe);)<8(|LT7/S;tkFΧIA^a{4fh7Qi'Q%ջ ?0S$!!fNqi#> Li聃(aM~qTeW"Z{DVeh5=䖙g,Aݓy.>#M$W&Qޢ?,h12R >v+琎ly=UefHW(doYTŸ3oa4>E3o%\G&L")Mask@-l˿ex_>Cѷ-}et߻Q ߹Aƛx#*يwt.}OgIմFiPiED3')4Nb-+OĈٟ\>Q*Cl7wXv* S2]FO.؞tQm LT{\0̗` 枾W+})Ii&7T)̫̉G"]Fw5@Ld'3_-e.ht`Vq)9Y86pK[1Fs9X50!!ޡcӕiH [O(War^c )N|len;+e4Gu[q(s;tp{_yZyKYRK0zO`,lOV-C^w,ԏ(tk AT*0Cԡ YQ7`dqh>Vxe[/9$[ I $pf(̨d.A`H+K#:6FG\FcB/ҵi:9gΕ,C{?\L=mf=W2%0h6˙b9&h|͉ -nN2^`9%$- 0hi*nH+UigGy:$ -?eҖ1&x񹄾Yjێj:LjT:0B5u~MHA8܌7DBҰZ+z#ڠa(.E"aeθtApcKIύaJb; :M.Q2|`Cf]jm~?BnF d[NsGduM+ag(]C.ˌ0/#U_֧צbP.|<<:Qc>s3ƜJ .H52]&V`j%rBsa$2qMrc`ZWZovxe~G\0L-=P&iAzYߎb2YX'N>&S-wQ_|7E:MX+XEYgXQI5嫈p*S\hjgD m͊{($9n#), EޯdʋN yr*Q> X"v]?#(Ivvf,3QQCŲs` xqn:43%uеwVJ+)֞7=|-VHy%Mzzq'Qi<^X7U:KY@wbIEeDcKu-lyZ |AgXK!`eWz ՃR;KYK$~dGxvvB5Z$Yrz`xyV61dVcׇN۽WС%̟ݻ塅 %_팁Y]Pt PBؼgRy v[Z@Gط^@ᥣS~=p[e JA&\?v8 \+*`6k^&V=Ű I%e.]nyD͙YCG.| ޳)2; }x@&ڧghO3O)~u>H5Ga*Krgh-c*'d!Il V&H b:Fw:&Z;Q}{PZgkWA5كEKP-f&-c29F "0#*.]{t\JtAHY{+ĸў\Tn4{Y@#]W<D1/)óMrZ/> Eb.{d AUt4"^ Î&ȑ :˗yTJx-g F65f-q#)0)^$ HI1#zn6T:ڐip=bE,fD1Flc/o`WD'2̸<<- ®wwd:9|ݘ-4eVW&$!ʜ>Te^Su3X50a Kt9?&8ŸiY %»fg`I]]aV49Vϑ]T˃5 QE/fP3\RjTq( V!iS6)7;ό-KQVa^G,U 6ьC8XP$9.)t[DV3- i['%klW\m%sh$>TxZFZZ2븐6؇9!%Z"c|MvwFJ7eHUI,_i+X…,gDnܵ^Eķ[QKA5Q~R@Lh$=Hh钔)3Tz4:(_X1+j۟9*7i*-gp \$Z gkS; OMR"2 ҮGfY!f!:EN>Zz lrٜ4]*4#ݽV3(<$ٗ,Hm=-&1ض ;l2zUv4C?M{]YcH ?Y;ۙǽI3~cR5me 9߁fQ\0e m+BjY!+<в 牛GYFr$W_8!m`~Oh52@K<]R9gZj`mjHXiGyޜ3J TupŮg!E<*nP>ekPwlsXM?ޤoŪ&sfytǯC@1ū`^n]hlYxδ8ǂA\$]0WŞG)X響6yr_%AɡL ۊ%/ʢk AaSQ}}杈9Vy@g%}} ~S/ټ/X]xF5a>⧫S;m{Cm3Un2rZ9X=%Rr(Q[{j/Y:k @-j#E;#SwBOK% Z0> YqKѐHKu +kZ}$H[QpdQ-Bn#_nPG [WbjEQQV1}uYHm|*am.5-f~;˽=JSM%[Ѣcx}GSܘ[*3 ZpNBF8[Uv%Fts3ޱhӃY>n !˩HT-2ބ4xl%jMMo鼺*UFl$,oǤeႷ}`C͵Y ǖX> ^9K.3ւjajDU ^W6Ӧ . -A8qPiϟBX7,dO RCwSe=xTdx6tƀ } 3Dva]{#:& DH'LE0 9P5Q&1J1I2TA/lCD ӌ)ֿq-]>wcǗ9./W:KwCLaDղiӆ )c0߯<%n٭D .1 ٲ<?=5f$")qߜ3}bL8:E,LVz:IdVB?et]Xa?M6HMŃ[ =Vq3vbѧ%/+2YGa\plSьtmE  NmF-#*\=5833ZsǞ8-* V#Q2Z2isj/p68323ｅO悴+mQTzޅmf\^X5l$]j8pzʈOKKל}E&e/TA5 .C'MV0aw{qr3' j?*3d$-:04S.Yu*&bIt1,3LbCtx(IefWkoc >[PZ>3cMأj[s&f>^˜{vƹ=!D ~==ܠԜ7c7(y{a#Hc_BCd 9y7bGQJj}&oh@4a9 :1-~PI ^TNl%- -@J~3.FX֕HG/Qv%%9_}@t+Y%Fzԍt¤3T*J_PA 80% fa=Qcb/Lδ2!aZω6 *{O$BKnāܒi;En4 Vw) <n<)b "VAy86OtBlзcuS!s {!9>|=Wx'ZD}-!m4O0zj}xa:JA>(o).;orZV6#x^8 |&Hi=iS$Ylxu&|A5GZ\`v&zu4^k!?m 1@ I5Nu*3nLƘks4/s9ia\8E`L^#%Cېj}R@r>fT+(A(*Ȑՠ_SuPTLB8(rh|[9\՟Ι"iyR̻%m!)(}$,B  f=ګWK+e.EC NaAQ0Df:ar#ؑ-MkXo}k)!OӐbėSLjaӧhՊ;f{fD{r޵Mzk.3_e*޾iH-w tQ|(`_"zP :SgoT J0'AQhW1l'0j6QTG#5ya L6pM='y\P$80W2BVaZ\i:z& BݹX-` .P `}CN`uAki%+Y ­3t%v No='d?(Iye֨H\ MSHK~ߘO*dUߜ4\ KNזhf1(rpU~,N+^4 N>m]dHQ]n; rdkus56J?tgi<"7ߩґI8_< 6si䯎Ze@*6ءM9W@!G{BHט;4N1,ۼ3tdfql死DaŤ4Dk @iLlNaMuqlUӆUߝV)i' YDJG7= (W`![TGҏpvS3P5jG@_F $m Ѵ V5#{\|ɂ(1nxrpWqbI,^MΦMK 'a?(OJ³K(5L+;6xfgUp-W -ǢěKaAL0 Z97JAn#mv J__(#f^7 vPj΄Œ ] AY*pUL~;}Ιl$?-Bx{!4}|m.T/S[~)@òZu|~q!sђP-_+3|Q c] Z0?9 [ |&Sŝ(\Rn庻y_$tn*lJ#HXqb8 ](g,b 0j6}"/lfQ+2^3 9s=a<@Faو:LzڶnStg2qBZje!U!H`,/sh`C|ܶ18e5~PZ2^Ʃxh"Q#{ ڈk>aD); ^rZH'h$&cq`AH=@mA`)ӆ& ɔ!IF"qԍ1|:pD!=v>ĂFnWF1Yj9&g\ɉblI{,"~ WD>^`6@< ߵ^hƼL?I[qp+b:#r{FfDڵ[Wz13d92SIjEJk 2ya0g/7@_L{*] V/[@e0ă*ˍ"ҌØo#eNo5X=lNmV Fi&c8mKZЇ +i±h,m1xJV }DAxlF̙`^A mj'wJj4k?{!n$~R cAZ_}Кȫ{G@ofJ1]4 $˯f./]q46:NkujR( 2e>@XNoŪ@vVD;m,15cǯm%(Eu]eÁ6bf%PtCZ9^+Mf™]%%xLZ- J}2NbhE;^A6جHl "'Q#-dy~?zKN/NPocvF*| q>7߿mȟ-i(9J`qwP-ƶ.N Vx<kS)a_/Mv_ Vb_U5nqUyy δ 0n'=z}Rd&ٍkX i,6QuepAjֳkmj wX;*a%|y.WQw[n^o#.UmD_NBPEӌ S-.9Y7waCes/@"3迱0m" 3K{$<Й雀ËKzC"skASSֈb |AePL${.FRsh`LԿZ1 q7(HJ8'ym_ -e +ڡT ^%q]Dˎ5>3X=!l^$!p-q7umG4];Eg471 z^;Gc`ckg1kK7Zn1R i#G{>݁g &oAMGbUPtX!@'R} t[&Ch55.=o/U!LRkfGЌ~];ɅߪvD_Qע v 1]30rMԽ A魨3?fEv(^O9yE˘1SGr`f/rx]R0Ƨ)4th!'ogEoXDggẙZң-X֧\MI]ia{:_~Wn.K-=f,^\ZLMMѵ Xܖo G ARF:}H!BK- Mv.wS)# z p!wޞFor$'X ai B s[ѠY;UExPv}JDEXB= fg{u71%J/7 lNYTupi!oKBy.)=6EX L+0lN\C%=UE^lxzƉtڶFS˙[յ~/e6s}dj?cМ3B_lt$zͱ~5Ŗa-Wh?|')[E:6by 9!,TK+:5WzC]h.<^bơ_Rzy5(?=e!u`m8ݭv|Qm!%&ju@lOJbV;LC X1P;?z3+=ft]U> ^ f|Uk񼶫;H$l:}OPH/' FˎZi̮+Gd\jPQtmT9R4eK+e+Oag rZ:~{H4U/\Dt=X|Vx?x,j%1GG\hk snOG8_ҿ<98,O/2?j@@d 8&1sږ$chlATdbdYiMulBJ> =;:?% KPAFo? (3iZ[Re:FR7UVP2tz-Oa~n 5gjmC (ɎZv ٫⍪ɆT<.YprzʇkJH'766 TݹUL\grգaӡWΣOjlZTo@Pls[8xe/t6\a8[(N0;5Jh08p|$bAra9KSӏ4pbY[.N :-~OunVqƫ l;"$^7T7Pf,)/J5n>Sנ䑵%_Ư\qAnYhyaw!A&\À>?Hqp%Ljg+}=ݽ+:.DmtTYc 704]B4@(\J5ns[R閦l r ^)q]jҕR"5ڬ1*&]IB, X ;ChATu#ڙ,5-P&!_f&WJ5nJ>L(ũU-F Дtݼpے;r"RSP ZJ+56'YSN2}ʗ}_iB`~ądC(<DfK`A!&"C쁔Ҥ<wϲf1&/R]=]OXüg=緎yXM9{^hР_:J\ʧzt+)WpN>͔|JI<'h rMRc,=ͨPY 7zTSz 苂I;#oSR\5bwϣK>n8xs'QQ~)}c2( &Hjcnane&fH:8]5$&G[uC^a_\|.8WWCgÀHT:U9~~4e 9+J(,Ki$|W `@H @$I4TH͉av=s”OoGXc*$`x‘RDjP ϕ\> 6}B J(o$$6i̱WW.7\N{c3~kBQpCT~:|eZ DlsaC:_t8\0\AJQ6FtELN!P,_|Oj򁞶1A6tDe$p_/QWu2'p[d4C\N)1!u3TIG>sXY?2`@)ߓ BSuUJn3hàD.VHɢK'!TOVHԓf=5z" ŠyR etL;ÏkfPIμ!dK^rWvO?EUU voqyNDZfj{16& x:̘'.}S)czt$ mWR yXh9vY[Pu_cݛ_kr.)$iwj t K$lQTM#gRwߍ^=$ϫm硥F㫰j"nQ.~k]x̤!6g*VE^qͤ)y}`= R| -ݍyQ52S IǑKe,}nEuuc`ԃZ4PPjWت֮e^7J*xtD]0%v+Ώ3{ĹlqEBOFX+\WcXBJ2і,@8/Ix=.x?H t&u+kQ2"^q  9ݸ*ߩJxJe*dsPǜ'k|'>ov1[%ab|RAt?^v_fa.هF5vx!q޴ȔxnI uD ڣ;jz|>hHxۖ8_CzU4}%^UFgNu.Ukb Ii`I=i0hB@{xiN3Iͥ-M6n5:%xZn)Q>i-x Gr#Lq KAr$ަk*ݱ$:|E<%C&} :^&>ð۩r[ivG2A&s|œ7?I^9SA.KO263搑<5=L-a e 8XHyXG8`* o}ݪq]t]ׯS6ʡt$'7z!NǸ^d * m)}{{oI,ՈksqXqi' FP~GQWAEA,|Mj%I%?@1+"tj]7 ڐsIrDm+D/;P\GNWLH@F!5\7S Ż8;iL h/FU5jPDL5f*/+J9d,5}F**ȴt43ؔylXh" iDgoecsx@ Oj7V:Opd9'z8ـIؘZc<%9/PGo;w@RB]'xvU-+jx~=ؼ,ҹc-! 袚Ro6HH-}|wKvIQ?x/IXKn <$i#H@r<66ah*mF1u fAug ₇E+EtW,$`ᩎ h2DS˙2yx \0U_4Ӓi?Ԟ&bx7Snu/G]T+(ʊ"I-8[N44w6p$wmnuF`6S,u6꺃_9sȩ$,s$ETg%{RS*}e&!u6ZY6dī;u. ߳-/cX"Ol|9>ξGW(+裼)7ɑhB`sSp5Z]Flg_*.zQ{!oL 2%OI(f^cKXjuOvTTZ8.~EKA'qή)VX0vPݓ"bgI%SYI;{dK,&rٓć@|8^2Jƭ%4 vOՖHOCd36f@߭+:GR4J=K͠ʬEG s*] 0M;b*yKJ~1Sda,Wt%lm)6kn''gc7^L١200<^gFJiX'.g 4 {ؽz!O ]@pHGMlJ-sc{]Έ>`A1DY(]iH`1`5]=BC;jtjc}H%=eA>;cvw+ᢿNsE2m[ mgJl?.n@el{4ޱI|*!*%k:i-y )`NLꪵ`c0xPZ{^DKAb2gvYFbp2WLwa @~OXuqM F܈dɦ>WzK8a.θigK65/F,cI|@ qq\gyI,tmBefrɫmQAABuֲr F^IgaKC4x#ng#$5xM^bI<{d(ϵDFiHr1")?:g] ZEyq Ѧ!BtBK{~zCX\Viw ^ ŧ!A+\bU |AH&tj|ڔqO9.?e?ؚ+71X \OH--B9 2 >rW8}'z K~eC4&{0=d^g@S=zCHs >>"rJYKPu#+L94͈eD3F3o VR{ h BO47Z}ER *O?&Rt d$-LNe1GɈxZ?, {LAw&2ARa M_iX )&J=08~ƷHz vPWk!_7׵꫕ +252bn?ĸ{reKc:el$& Z&6l-yqor CT%K ({&9%ɭ@C> 9ܛS]9 cA5]b6vA4v<'tzw"6`_=_XfUMO! Zw3L/*]P!CCp#*Θr/{iK@H)տŠ9WjC%szf/^d?5ىkY l$-TݞI"WN{׊\|p%׼8(htẽ?Pϩϱw"1 y&$Jl˪ \ hF4=!Ohܶ /4/1['[YWm^"^wBDU uT=tl v!Eic7s6xL2jqs6z~Ãj. fߡ@vk60'3?ȅld^_y pb D^ҖIȲ81l?Zˇo.z˖Tp*n,sd'm?,F%p|KCNօY%G ԃ9ӫ?#.a>l i$] qn&q%ixݟ?y{r+N5r}tG-6nKd9٭Mc"ѾϕIGfntpHvP7#keYC 7Iՠbz89 'Rɡt*ZkWYawj=gb#R_i*emAd=Ą ?_*(Ekpg" )dR%fڢ7H7v#l~ ɷv |= Z?|W<*LWU^_va/@w]LSe:>DΛhI6&޲`u3P5+K7P'McXjv4#>mHJ++_!:tu¦KY06.2 ђzNag^RY, nt#m6uӃђG=,KGdI4br4p"5g-XT{<yz* :,(t;2ʰέN< qKzn&ѹ՞k~#`C0m{cVx(;ɾr)$V@)l–[Cp0t'5jfDt.%hXm~ 220/-C2<BqS3EZ$:\X#} =1J"/'11:r-wAxYrV=Q>}&rwyӾwuG@y]x"hAэ-eFʌq4o7tS6A`$=RqlKO ~'^Bo(29.R`:<QɫP^ '7_"x`et;ܘ5[pp»lкS4T_; ǿ֓@CQئcwʂׯ,'~C?Uf#$PY`\th"rdQUoeƩpPZ ~4/Aküa.Fiohy)|\-ˢ͑UzvٺϢ0,i01`hY.zҁ 9u(TèY5e[>WLosOhP )*@ﻞ2eB$'ڊC Sr1<84Ҿ-/ ׃Nq,* hZj/̽rC?% t."{y)mWd n%KI^ xq2DRktNiՅ]rVjb(/٧Љ>;vo^ ՚(GomrSmhUM>fۈe-P1[9R!+=%$Oi:@D6Q ͑?)8ڵϒ6oѿ,}ŢOیüNJIʃݮ&eڥh:yGH6s>3Q* FN{=-Sj(EQ|.` j/(PSwMrPz9|i ;K^Ǔ+P߳%b?-`:yAvXfNcCKL_(٦!'u4:#tuR$$AB b7u4ul| L$jUì8̍6_?"!te9}}J7ieN='i@󤩼>'A S'bƅJ{E <XM\߬{aзre8 Jje `XX:B`lԖN+&,5+N8N eUrR3|EUNgLxVMA#b2!I*X$NH5SUF̨Y d~4ag 26KO*M*Jە8–~up ~6q\m#ړC3Wv`قfIvy=]. 1ʥ㊊Y抃83mѫxsA6ʉQ^sf]R$Vl%t$TՈyr ~qIxk*."DULkӑ\^V)&X>)눴<Bhg/p7(mSkcb<jj4vz;I6mhj\3X=fVS7V8Qi/XRhT}9$BYĶ 6yB dZ2JA {Qz[7Ef[0)Zg>ڏ1EoWVQ@2c!T.x$V3 h"/$vJ1NJW 358AI|e# ܆jBÏ \ )v8pc:عW~~StD4&?Y| Ϲ6AuK=* 7C8-@K&EIEdG)/1|Y*L8}G,WY$'SW`Kh -{}]P3Ѻ@@g s2%%㖱GWĥ;E:_Dɧ~/1è.Cm|X2S.iGf+b&eA"mdǮc*m}Y4P|TԚ)!+qyNI–7l@__Y+OffZOy8(8p\CA%. 1*ߜ蠒s꧄o+jD&z=ށlXb7?Q3PYDGV%8/t U<!#Ql+ M;fx<08z?N&Ğ,!pBk P1Bxwo8M@k:佉Fֲ$4KrTl/P@h}7?ij}Y|hnWS(nm=~|ͥu0XM2kCex7 J:.ґ ˰ޛb\)D]t :#MNF(:.ς_mb9ތ϶n<܁=Ek~3D–*\`t3 $$!vXKBb(;Pk( [ ~[\_\P$ b/]$R݃/Lf1yy!= AjL?l-ϛK\7ZV:5MTbB.i+f" !!׈qUr]VxI_@Ӯe4 UB#-@{(@۵sgy7Q&+SfBޖUuw.O~BSx Ah(pBx#i'A{wfH*z/UxL]^M&Q 8-n[ V&˵= z z]}Se,vQ>2 %<>ŠHLq^o҈3D ~ )td3~]T|d!b fK~:B(Ζr ΣpQȫоVk_Nn5Qږ鮒>[S*Br%:l O0QWE7lLxc .H'é[VR4|fʙYA {P:a_i_1v 'l1d% f'_[dAw=yA ߕ;h4e/&{2ul;<9Àђ' .V> 0Xe]wiNyBS>-i4hyV2։D–5?a#b, We4'?EyuKS' {~ke2MPj)v]J{;sπ7h69/=L8#,~{ZQ0͝ 82d%3]'3W\+ϗt; `y h)AAw.w"CpNӝeӋ룲TpjNxV&_, eH-J =Yp-7#H Rl&,׆jHPd[pA/-Lm C[j)rb+[ Z`SW%@Lָ?-k 3̬m Se*c.St\}]te6Ț=GI2|*HJNmḦ́Hq麗Hk.ٔ* Btilb+7Z\֭myw¬jyo8ӭag6i'3wW 7ø=d fͥpMi~a9w{PmGWz$ GnS&)!u̫IvҞwކ=uz/:u" Ba\gB<>0}-2[m)ޠlFe0BÔꭥ=r(B~"NPl/ ;4!`A }0U%7I_4SfrX0t5!<[ŇV{ Oi:p5F͂R0ƍ<ᤳ"^8nơ뤿oh<R[ƔA*'&jCEU0T2W"&fM5qX ڋ7p]; עF4 蝗]ƛe~,x7KLct%v 47kyͯ|x{1 ?pMQzAo)^' is%:NgZ PS5ѐ*@Xy#0~p;u1D0^9N4tҁ=ƣn NVy?uީZϖ T u(ʦKJN%4p:ͧӚmr\G Yxvcyd#-AX@C/Unѭyƾͮ=,x, 48=ɛ`nKUyQ!.j0MO4.g[̻y9Nc0BKX٤5F{pk=\>X)bOP #0\u0*UW޻%ITWo|D^eCFOF-DQ~F36[#"  >_Ix_FuڲJ@H[,/ʖZ!|R^FPԙ$g^J̖[—>ṔYim.n,P%rZ{wbֵ&$]G(}T?a/$YPl!7C*xbJ%n!;[öVVO[7{ע]`%c':7P.i6ɞ~k[ơG`2+ڐ?wK澺[rP4ƫ(1-zX+JtKn'qshpezxB﮹2<( >6h6!lmή.4dr>Y\~ p '05"k Zdv"=uʼ1 >9H[up c-P:䏎w@}j,Gs?ӛrRK7yg&\N#0&87)UwN;e̖S3Y9%& l~A;ikBa_yHsGb0G?^#ݞ>mLYas/i;:"Pi? sqƌ*R_fV 䛖9P3顜i,6Nh YDfִ  Cͦ^??{*($bPXR0[YǯXeIy+>Cb+ \&|4iXr(dk-c;ؤvplw`j"2NyF 58No.&y&*=Dǹr5Vǟ(~*>q~#IXpS>as{(kWq!-yk+cnZl[kEU`jZ-v0sa{(ܐ o1j^ɿb\n T 6t