wpa_supplicant-gui-2.10-150600.7.6.1<>,爉g"ep9|msmhPcoe5EQQҦsY3U/c>*?"ݫ9b0'MPvCxv 35c~=[ ~C@ *PȒ(e(hW䓐.5fYާܿ&f8Ësk)Zx!]F)a9ۯZu>>8?(d ' J , BNkqx     &0\d(8+9d+: +FfG|HIXY\]^bcd+e0f3l5uHvPwlxty|z$Cwpa_supplicant-gui2.10150600.7.6.1WPA supplicant graphical front-endThis package contains a graphical front-end to wpa_supplicant, an implementation of the WPA Supplicant component.g"es390zl33 |SUSE Linux Enterprise 15SUSE LLC BSD-3-Clause AND GPL-2.0-or-laterhttps://www.suse.com/Unspecifiedhttps://w1.fi/wpa_supplicantlinuxs390x x큤g"`g"X2cfa63f188d153d581081ec9e97be0e09e20165e668413faff6752bc358361b7d57783ead2cca37539bf8b5c4a81b8105c2970de177652fe1a027433593467aarootrootrootrootwpa_supplicant-2.10-150600.7.6.1.src.rpmwpa_supplicant-guiwpa_supplicant-gui(s390-64)@@@@@@@@@@@@@@@@@@@    libQt5Core.so.5()(64bit)libQt5Core.so.5(Qt_5)(64bit)libQt5Gui.so.5()(64bit)libQt5Gui.so.5(Qt_5)(64bit)libQt5Widgets.so.5()(64bit)libQt5Widgets.so.5(Qt_5)(64bit)libc.so.6()(64bit)libc.so.6(GLIBC_2.15)(64bit)libc.so.6(GLIBC_2.17)(64bit)libc.so.6(GLIBC_2.2)(64bit)libc.so.6(GLIBC_2.34)(64bit)libc.so.6(GLIBC_2.38)(64bit)libc.so.6(GLIBC_2.4)(64bit)libgcc_s.so.1()(64bit)libgcc_s.so.1(GCC_3.0)(64bit)libstdc++.so.6()(64bit)libstdc++.so.6(CXXABI_1.3)(64bit)libstdc++.so.6(CXXABI_1.3.9)(64bit)libstdc++.so.6(GLIBCXX_3.4)(64bit)rpmlib(CompressedFileNames)rpmlib(FileDigests)rpmlib(PayloadFilesHavePrefix)rpmlib(PayloadIsXz)wpa_supplicant3.0.4-14.6.0-14.0-15.2-14.14.3ge}@c@b@b@`lM@`?z@`:4@`_|\@_i@_i@^@^@^|@^|@^Y]]>[<@[[ā@[[;@[@[QY@X@X]W@VU@VŲ@V`V=@UKSUCjU8U'@U/@TBV@cfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comcfamullaconrad@suse.comsp1ritCS@protonmail.comcfamullaconrad@suse.comsongchuan.kang@suse.comcfamullaconrad@suse.combwiedemann@suse.comcfamullaconrad@suse.comilya@ilya.pp.uatchvatal@suse.comtchvatal@suse.comilya@ilya.pp.uailya@ilya.pp.uakbabioch@suse.comro@suse.dekbabioch@suse.comkbabioch@suse.comkbabioch@suse.comro@suse.demeissner@suse.comobs@botter.ccdwaas@suse.commeissner@suse.comtchvatal@suse.comlnussel@suse.decrrodriguez@opensuse.orgcrrodriguez@opensuse.orgcrrodriguez@opensuse.orglnussel@suse.demichael@stroeder.comro@suse.dezaitor@opensuse.orgcrrodriguez@opensuse.orgstefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.destefan.bruens@rwth-aachen.de- CVE-2025-24912: hostapd fails to process crafted RADIUS packets properly (bsc#1239461) [+ CVE-2025-24912.patch]- Add CVE-2023-52160.patch - Bypassing WiFi Authentication (bsc#1219975) - Change ctrl_interface from /var/run to %_rundir (/run)- update to 2.10.0: jsc#PED-2904 * SAE changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] - added support for the hash-to-element mechanism (sae_pwe=1 or sae_pwe=2); this is currently disabled by default, but will likely get enabled by default in the future - fixed PMKSA caching with OKC - added support for SAE-PK * EAP-pwd changes - improved protection against side channel attacks [https://w1.fi/security/2022-1/] * fixed P2P provision discovery processing of a specially constructed invalid frame [https://w1.fi/security/2021-1/] * fixed P2P group information processing of a specially constructed invalid frame [https://w1.fi/security/2020-2/] * fixed PMF disconnection protection bypass in AP mode [https://w1.fi/security/2019-7/] * added support for using OpenSSL 3.0 * increased the maximum number of EAP message exchanges (mainly to support cases with very large certificates) * fixed various issues in experimental support for EAP-TEAP peer * added support for DPP release 2 (Wi-Fi Device Provisioning Protocol) * a number of MKA/MACsec fixes and extensions * added support for SAE (WPA3-Personal) AP mode configuration * added P2P support for EDMG (IEEE 802.11ay) channels * fixed EAP-FAST peer with TLS GCM/CCM ciphers * improved throughput estimation and BSS selection * dropped support for libnl 1.1 * added support for nl80211 control port for EAPOL frame TX/RX * fixed OWE key derivation with groups 20 and 21; this breaks backwards compatibility for these groups while the default group 19 remains backwards compatible * added support for Beacon protection * added support for Extended Key ID for pairwise keys * removed WEP support from the default build (CONFIG_WEP=y can be used to enable it, if really needed) * added a build option to remove TKIP support (CONFIG_NO_TKIP=y) * added support for Transition Disable mechanism to allow the AP to automatically disable transition mode to improve security * extended D-Bus interface * added support for PASN * added a file-based backend for external password storage to allow secret information to be moved away from the main configuration file without requiring external tools * added EAP-TLS peer support for TLS 1.3 (disabled by default for now) * added support for SCS, MSCS, DSCP policy * changed driver interface selection to default to automatic fallback to other compiled in options * a large number of other fixes, cleanup, and extensions - drop wpa_supplicant-p2p_iname_size.diff, CVE-2021-30004.patch, CVE-2021-27803.patch, CVE-2021-0326.patch, CVE-2019-16275.patch, CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch: upstream - drop restore-old-dbus-interface.patch, wicked has been switching to the new dbus interface in version 0.6.66 - config: * re-enable CONFIG_WEP * enable QCA vendor extensions to nl80211 * enable support for Automatic Channel Selection * enable OCV, security feature that prevents MITM multi-channel attacks * enable QCA vendor extensions to nl80211 * enable EAP-EKE * Support HT overrides * TLS v1.1 and TLS v1.2 * Fast Session Transfer (FST) * Automatic Channel Selection * Multi Band Operation * Fast Initial Link Setup * Mesh Networking (IEEE 802.11s) - Add dbus-Fix-property-DebugShowKeys-and-DebugTimestamp.patch (bsc#1201219) - Move the dbus-1 system.d file to /usr (bsc#1200342) - Added hardening to systemd service(s) (bsc#1181400). Modified: * wpa_supplicant.service - drop wpa_supplicant-getrandom.patch : glibc has been updated so the getrandom() wrapper is now there - Sync wpa_supplicant.spec with Factory- Enable WPA3-Enterprise (SuiteB-192) support.- Add CVE-2022-23303_0001.patch, CVE-2022-23303_0002.patch, CVE-2022-23303_0003.patch, CVE-2022-23303_0004.patch SAE/EAP-pwd side-channel attack update 2 (CVE-2022-23303, CVE-2022-23304, bsc#1194732, bsc#1194733)- Add CVE-2021-30004.patch -- forging attacks may occur because AlgorithmIdentifier parameters are mishandled in tls/pkcs1.c and tls/x509v3.c (bsc#1184348)- Fix systemd device ready dependencies in wpa_supplicant@.service file. (see: https://forums.opensuse.org/showthread.php/547186-wpa_supplicant-service-fails-on-boot-succeeds-on-restart?p=2982844#post2982844)- Add CVE-2021-27803.patch -- P2P provision discovery processing vulnerability (bsc#1182805)- Add CVE-2021-0326.patch -- P2P group information processing vulnerability (bsc#1181777)- Add wpa_supplicant-p2p_iname_size.diff -- Limit P2P_DEVICE name to appropriate ifname size (https://patchwork.ozlabs.org/project/hostap/patch/20200825062902.124600-1-benjamin@sipsolutions.net/)- Fix spec file for SLE12, use make %{?_smp_mflags} instead of %make_build- Enable SAE support(jsc#SLE-14992).- Add CVE-2019-16275.patch -- AP mode PMF disconnection protection bypass (bsc#1150934)- Add restore-old-dbus-interface.patch to fix wicked wlan (boo#1156920) - Restore fi.epitest.hostap.WPASupplicant.service (bsc#1167331)- With v2.9 fi.epitest.hostap.WPASupplicant.service is obsolete (bsc#1167331)- Change wpa_supplicant.service to ensure wpa_supplicant gets started before network. Fix WLAN config on boot with wicked. (boo#1166933)- Adjust the service to start after network.target wrt bsc#1165266- Update to 2.9 release: * SAE changes - disable use of groups using Brainpool curves - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * EAP-pwd changes - disable use of groups using Brainpool curves - allow the set of groups to be configured (eap_pwd_groups) - improved protection against side channel attacks [https://w1.fi/security/2019-6/] * fixed FT-EAP initial mobility domain association using PMKSA caching (disabled by default for backwards compatibility; can be enabled with ft_eap_pmksa_caching=1) * fixed a regression in OpenSSL 1.1+ engine loading * added validation of RSNE in (Re)Association Response frames * fixed DPP bootstrapping URI parser of channel list * extended EAP-SIM/AKA fast re-authentication to allow use with FILS * extended ca_cert_blob to support PEM format * improved robustness of P2P Action frame scheduling * added support for EAP-SIM/AKA using anonymous@realm identity * fixed Hotspot 2.0 credential selection based on roaming consortium to ignore credentials without a specific EAP method * added experimental support for EAP-TEAP peer (RFC 7170) * added experimental support for EAP-TLS peer with TLS v1.3 * fixed a regression in WMM parameter configuration for a TDLS peer * fixed a regression in operation with drivers that offload 802.1X 4-way handshake * fixed an ECDH operation corner case with OpenSSL * SAE changes - added support for SAE Password Identifier - changed default configuration to enable only groups 19, 20, 21 (i.e., disable groups 25 and 26) and disable all unsuitable groups completely based on REVmd changes - do not regenerate PWE unnecessarily when the AP uses the anti-clogging token mechanisms - fixed some association cases where both SAE and FT-SAE were enabled on both the station and the selected AP - started to prefer FT-SAE over SAE AKM if both are enabled - started to prefer FT-SAE over FT-PSK if both are enabled - fixed FT-SAE when SAE PMKSA caching is used - reject use of unsuitable groups based on new implementation guidance in REVmd (allow only FFC groups with prime >= 3072 bits and ECC groups with prime >= 256) - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-1/] (CVE-2019-9494, bsc#1131868) * EAP-pwd changes - minimize timing and memory use differences in PWE derivation [https://w1.fi/security/2019-2/] (CVE-2019-9495, bsc#1131870) - verify server scalar/element [https://w1.fi/security/2019-4/] (CVE-2019-9497, CVE-2019-9498, CVE-2019-9499, bsc#1131874, bsc#1131872, bsc#1131871, bsc#1131644) - fix message reassembly issue with unexpected fragment [https://w1.fi/security/2019-5/] (CVE-2019-11555, bsc#1133640) - enforce rand,mask generation rules more strictly - fix a memory leak in PWE derivation - disallow ECC groups with a prime under 256 bits (groups 25, 26, and 27) - SAE/EAP-pwd side-channel attack update [https://w1.fi/security/2019-6/] (CVE-2019-13377, bsc#1144443) * fixed CONFIG_IEEE80211R=y (FT) build without CONFIG_FILS=y * Hotspot 2.0 changes - do not indicate release number that is higher than the one AP supports - added support for release number 3 - enable PMF automatically for network profiles created from credentials * fixed OWE network profile saving * fixed DPP network profile saving * added support for RSN operating channel validation (CONFIG_OCV=y and network profile parameter ocv=1) * added Multi-AP backhaul STA support * fixed build with LibreSSL * number of MKA/MACsec fixes and extensions * extended domain_match and domain_suffix_match to allow list of values * fixed dNSName matching in domain_match and domain_suffix_match when using wolfSSL * started to prefer FT-EAP-SHA384 over WPA-EAP-SUITE-B-192 AKM if both are enabled * extended nl80211 Connect and external authentication to support SAE, FT-SAE, FT-EAP-SHA384 * fixed KEK2 derivation for FILS+FT * extended client_cert file to allow loading of a chain of PEM encoded certificates * extended beacon reporting functionality * extended D-Bus interface with number of new properties * fixed a regression in FT-over-DS with mac80211-based drivers * OpenSSL: allow systemwide policies to be overridden * extended driver flags indication for separate 802.1X and PSK 4-way handshake offload capability * added support for random P2P Device/Interface Address use * extended PEAP to derive EMSK to enable use with ERP/FILS * extended WPS to allow SAE configuration to be added automatically for PSK (wps_cred_add_sae=1) * removed support for the old D-Bus interface (CONFIG_CTRL_IFACE_DBUS) * extended domain_match and domain_suffix_match to allow list of values * added a RSN workaround for misbehaving PMF APs that advertise IGTK/BIP KeyID using incorrect byte order * fixed PTK rekeying with FILS and FT * fixed WPA packet number reuse with replayed messages and key reinstallation [https://w1.fi/security/2017-1/] (CVE-2017-13077, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13082, CVE-2017-13086, CVE-2017-13087, CVE-2017-13088) * fixed unauthenticated EAPOL-Key decryption in wpa_supplicant [https://w1.fi/security/2018-1/] (CVE-2018-14526) * added support for FILS (IEEE 802.11ai) shared key authentication * added support for OWE (Opportunistic Wireless Encryption, RFC 8110; and transition mode defined by WFA) * added support for DPP (Wi-Fi Device Provisioning Protocol) * added support for RSA 3k key case with Suite B 192-bit level * fixed Suite B PMKSA caching not to update PMKID during each 4-way handshake * fixed EAP-pwd pre-processing with PasswordHashHash * added EAP-pwd client support for salted passwords * fixed a regression in TDLS prohibited bit validation * started to use estimated throughput to avoid undesired signal strength based roaming decision * MACsec/MKA: - new macsec_linux driver interface support for the Linux kernel macsec module - number of fixes and extensions * added support for external persistent storage of PMKSA cache (PMKSA_GET/PMKSA_ADD control interface commands; and MESH_PMKSA_GET/MESH_PMKSA_SET for the mesh case) * fixed mesh channel configuration pri/sec switch case * added support for beacon report * large number of other fixes, cleanup, and extensions * added support for randomizing local address for GAS queries (gas_rand_mac_addr parameter) * fixed EAP-SIM/AKA/AKA' ext auth cases within TLS tunnel * added option for using random WPS UUID (auto_uuid=1) * added SHA256-hash support for OCSP certificate matching * fixed EAP-AKA' to add AT_KDF into Synchronization-Failure * fixed a regression in RSN pre-authentication candidate selection * added option to configure allowed group management cipher suites (group_mgmt network profile parameter) * removed all PeerKey functionality * fixed nl80211 AP and mesh mode configuration regression with Linux 4.15 and newer * added ap_isolate configuration option for AP mode * added support for nl80211 to offload 4-way handshake into the driver * added support for using wolfSSL cryptographic library * SAE - added support for configuring SAE password separately of the WPA2 PSK/passphrase - fixed PTK and EAPOL-Key integrity and key-wrap algorithm selection for SAE; note: this is not backwards compatible, i.e., both the AP and station side implementations will need to be update at the same time to maintain interoperability - added support for Password Identifier - fixed FT-SAE PMKID matching * Hotspot 2.0 - added support for fetching of Operator Icon Metadata ANQP-element - added support for Roaming Consortium Selection element - added support for Terms and Conditions - added support for OSEN connection in a shared RSN BSS - added support for fetching Venue URL information * added support for using OpenSSL 1.1.1 * FT - disabled PMKSA caching with FT since it is not fully functional - added support for SHA384 based AKM - added support for BIP ciphers BIP-CMAC-256, BIP-GMAC-128, BIP-GMAC-256 in addition to previously supported BIP-CMAC-128 - fixed additional IE inclusion in Reassociation Request frame when using FT protocol - Drop merged patches: * rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch * rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch * rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch * rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch * rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch * rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch * rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch * rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch * rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch * wpa_supplicant-bnc-1099835-fix-private-key-password.patch * wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch * wpa_supplicant-log-file-permission.patch * wpa_supplicant-log-file-cloexec.patch * wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch * wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch - Rebase patches: * wpa_supplicant-getrandom.patch- Refresh spec-file via spec-cleaner and manual optimizations. * Change URL and Source0 to actual project homepage. * Remove macro %{?systemd_requires} and rm (not needed). * Add %autopatch macro. * Add %make_build macro. - Chenged patch wpa_supplicant-flush-debug-output.patch (to -p1). - Changed service-files for start after network (systemd-networkd).- Refresh spec-file: add %license tag.- Renamed patches: - wpa-supplicant-log-file-permission.patch -> wpa_supplicant-log-file-permission.patch - wpa-supplicant-log-file-cloexec.patch -> wpa_supplicant-log-file-cloexec.patch - wpa_supplicant-log-file-permission.patch: Using O_WRONLY flag - Enabled timestamps in log files (bsc#1080798)- compile eapol_test binary to allow testing via radius proxy and server (note: this does not match CONFIG_EAPOL_TEST which sets -Werror and activates an assert call inside the code of wpa_supplicant) (bsc#1111873), (fate#326725) - add patch to fix wrong operator precedence in ieee802_11.c wpa_supplicant-git-fa67debf4c6ddbc881a212b175faa6d5d0d90c8c.patch - add patch to avoid redefinition of __bitwise macro wpa_supplicant-git-f5b74b966c942feb95a8ddbb7d130540b15b796d.patch- Added wpa-supplicant-log-file-permission.patch: Fixes the default file permissions of the debug log file to more sane values, i.e. it is no longer world-readable (bsc#1098854). - Added wpa-supplicant-log-file-cloexec.patch: Open the debug log file with O_CLOEXEC, which will prevent file descriptor leaking to child processes (bsc#1098854).- Added rebased-v2.6-0009-WPA-Ignore-unauthenticated-encrypted-EAPOL-Key-data.patch: Ignore unauthenticated encrypted EAPOL-Key data (CVE-2018-14526, bsc#1104205).- Enabled PWD as EAP method. This allows for password-based authentication, which is easier to setup than most of the other methods, and is used by the Eduroam network (bsc#1109209).- add two patches from upstream to fix reading private key passwords from the configuration file (bsc#1099835) - add patch for git 89971d8b1e328a2f79699c953625d1671fd40384 wpa_supplicant-bnc-1099835-clear-default_passwd_cb.patch - add patch for git f665c93e1d28fbab3d9127a8c3985cc32940824f wpa_supplicant-bnc-1099835-fix-private-key-password.patch- Fix KRACK attacks (bsc#1056061, CVE-2017-13078, CVE-2017-13079, CVE-2017-13080, CVE-2017-13081, CVE-2017-13087, CVE-2017-13088): - rebased-v2.6-0001-hostapd-Avoid-key-reinstallation-in-FT-handshake.patch - rebased-v2.6-0002-Prevent-reinstallation-of-an-already-in-use-group-ke.patch - rebased-v2.6-0003-Extend-protection-of-GTK-IGTK-reinstallation-of-WNM-.patch - rebased-v2.6-0004-Prevent-installation-of-an-all-zero-TK.patch - rebased-v2.6-0005-Fix-PTK-rekeying-to-generate-a-new-ANonce.patch - rebased-v2.6-0006-TDLS-Reject-TPK-TK-reconfiguration.patch - rebased-v2.6-0007-WNM-Ignore-WNM-Sleep-Mode-Response-without-pending-r.patch - rebased-v2.6-0008-FT-Do-not-allow-multiple-Reassociation-Response-fram.patch- fix wpa_supplicant-sigusr1-changes-debuglevel.patch to match eloop_signal_handler type (needed to build eapol_test via config)- Added .service files that accept interfaces as %i arguments so it's possible to call the daemon with: "systemctl start wpa_supplicant@$INTERFACE_NAME.service" (like openvpn for example)- updated to 2.6 / 2016-10-02 * fixed WNM Sleep Mode processing when PMF is not enabled [http://w1.fi/security/2015-6/] (CVE-2015-5310 bsc#952254) * fixed EAP-pwd last fragment validation [http://w1.fi/security/2015-7/] (CVE-2015-5315 bsc#953115) * fixed EAP-pwd unexpected Confirm message processing [http://w1.fi/security/2015-8/] (CVE-2015-5316 bsc#953115) * fixed WPS configuration update vulnerability with malformed passphrase [http://w1.fi/security/2016-1/] (CVE-2016-4476 bsc#978172) * fixed configuration update vulnerability with malformed parameters set over the local control interface [http://w1.fi/security/2016-1/] (CVE-2016-4477 bsc#978175) * fixed TK configuration to the driver in EAPOL-Key 3/4 retry case * extended channel switch support for P2P GO * started to throttle control interface event message bursts to avoid issues with monitor sockets running out of buffer space * mesh mode fixes/improvements - generate proper AID for peer - enable WMM by default - add VHT support - fix PMKID derivation - improve robustness on various exchanges - fix peer link counting in reconnect case - improve mesh joining behavior - allow DTIM period to be configured - allow HT to be disabled (disable_ht=1) - add MESH_PEER_ADD and MESH_PEER_REMOVE commands - add support for PMKSA caching - add minimal support for SAE group negotiation - allow pairwise/group cipher to be configured in the network profile - use ieee80211w profile parameter to enable/disable PMF and derive a separate TX IGTK if PMF is enabled instead of using MGTK incorrectly - fix AEK and MTK derivation - remove GTKdata and IGTKdata from Mesh Peering Confirm/Close - note: these changes are not fully backwards compatible for secure (RSN) mesh network * fixed PMKID derivation with SAE * added support for requesting and fetching arbitrary ANQP-elements without internal support in wpa_supplicant for the specific element (anqp[265]= in "BSS " command output) * P2P - filter control characters in group client device names to be consistent with other P2P peer cases - support VHT 80+80 MHz and 160 MHz - indicate group completion in P2P Client role after data association instead of already after the WPS provisioning step - improve group-join operation to use SSID, if known, to filter BSS entries - added optional ssid= argument to P2P_CONNECT for join case - added P2P_GROUP_MEMBER command to fetch client interface address * P2PS - fix follow-on PD Response behavior - fix PD Response generation for unknown peer - fix persistent group reporting - add channel policy to PD Request - add group SSID to the P2PS-PROV-DONE event - allow "P2P_CONNECT p2ps" to be used without specifying the default PIN * BoringSSL - support for OCSP stapling - support building of h20-osu-client * D-Bus - add ExpectDisconnect() - add global config parameters as properties - add SaveConfig() - add VendorElemAdd(), VendorElemGet(), VendorElemRem() * fixed Suite B 192-bit AKM to use proper PMK length (note: this makes old releases incompatible with the fixed behavior) * improved PMF behavior for cases where the AP and STA has different configuration by not trying to connect in some corner cases where the connection cannot succeed * added option to reopen debug log (e.g., to rotate the file) upon receipt of SIGHUP signal * EAP-pwd: added support for Brainpool Elliptic Curves (with OpenSSL 1.0.2 and newer) * fixed EAPOL reauthentication after FT protocol run * fixed FTIE generation for 4-way handshake after FT protocol run * extended INTERFACE_ADD command to allow certain type (sta/ap) interface to be created * fixed and improved various FST operations * added 80+80 MHz and 160 MHz VHT support for IBSS/mesh * fixed SIGNAL_POLL in IBSS and mesh cases * added an option to abort an ongoing scan (used to speed up connection and can also be done with the new ABORT_SCAN command) * TLS client - do not verify CA certificates when ca_cert is not specified - support validating server certificate hash - support SHA384 and SHA512 hashes - add signature_algorithms extension into ClientHello - support TLS v1.2 signature algorithm with SHA384 and SHA512 - support server certificate probing - allow specific TLS versions to be disabled with phase2 parameter - support extKeyUsage - support PKCS #5 v2.0 PBES2 - support PKCS #5 with PKCS #12 style key decryption - minimal support for PKCS #12 - support OCSP stapling (including ocsp_multi) * OpenSSL - support OpenSSL 1.1 API changes - drop support for OpenSSL 0.9.8 - drop support for OpenSSL 1.0.0 * added support for multiple schedule scan plans (sched_scan_plans) * added support for external server certificate chain validation (tls_ext_cert_check=1 in the network profile phase1 parameter) * made phase2 parser more strict about correct use of auth= and autheap= values * improved GAS offchannel operations with comeback request * added SIGNAL_MONITOR command to request signal strength monitoring events * added command for retrieving HS 2.0 icons with in-memory storage (REQ_HS20_ICON, GET_HS20_ICON, DEL_HS20_ICON commands and RX-HS20-ICON event) * enabled ACS support for AP mode operations with wpa_supplicant * EAP-PEAP: fixed interoperability issue with Windows 2012r2 server ("Invalid Compound_MAC in cryptobinding TLV") * EAP-TTLS: fixed success after fragmented final Phase 2 message * VHT: added interoperability workaround for 80+80 and 160 MHz channels * WNM: workaround for broken AP operating class behavior * added kqueue(2) support for eloop (CONFIG_ELOOP_KQUEUE) * nl80211: - add support for full station state operations - do not add NL80211_ATTR_SMPS_MODE attribute if HT is disabled - add NL80211_ATTR_PREV_BSSID with Connect command - fix IEEE 802.1X/WEP EAP reauthentication and rekeying to use unencrypted EAPOL frames * added initial MBO support; number of extensions to WNM BSS Transition Management * added support for PBSS/PCP and P2P on 60 GHz * Interworking: add credential realm to EAP-TLS identity * fixed EAPOL-Key Request Secure bit to be 1 if PTK is set * HS 2.0: add support for configuring frame filters * added POLL_STA command to check connectivity in AP mode * added initial functionality for location related operations * started to ignore pmf=1/2 parameter for non-RSN networks * added wps_disabled=1 network profile parameter to allow AP mode to be started without enabling WPS * wpa_cli: added action script support for AP-ENABLED and AP-DISABLED events * improved Public Action frame addressing - add gas_address3 configuration parameter to control Address 3 behavior * number of small fixes - wpa_supplicant-dump-certificate-as-PEM-in-debug-mode.diff: dump x509 certificates from remote radius server in debug mode in WPA-EAP.- Remove support for <12.3 as we are unresolvable there anyway - Use qt5 on 13.2 if someone pulls this package in - Convert to pkgconfig dependencies over the devel pkgs - Use the %qmake5 macro to build the qt5 gui- add After=dbus.service to prevent too early shutdown (bnc#963652)- Revert CONFIG_ELOOP_EPOLL=y, it is broken in combination with CONFIG_DBUS=yes.- spec: Compile the GUI against QT5 in 13.2 and later.- Previous update did not include version 2.5 tarball or changed the version number in spec, only the changelog and removed patches. - config: set CONFIG_NO_RANDOM_POOL=y, we have a reliable· random number generator by using /dev/urandom, no need to keep an internal random number pool which draws entropy from /dev/random. - config: prefer using epoll(7) instead of select(2) by setting CONFIG_ELOOP_EPOLL=y - wpa_supplicant-getrandom.patch: Prefer to use the getrandom(2) system call to collect entropy. if it is not present disable buffering when reading /dev/urandom, otherwise each os_get_random() call will request BUFSIZ of entropy instead of the few needed bytes.- add aliases for both provided dbus names to avoid systemd stopping the service when switching runlevels (boo#966535)- removed obsolete security patches: * 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch * 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch * 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch * 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch * wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch * 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch * 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch * 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch * 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch - Update to upstream release 2.5 * fixed P2P validation of SSID element length before copying it [http://w1.fi/security/2015-1/] (CVE-2015-1863) * fixed WPS UPnP vulnerability with HTTP chunked transfer encoding [http://w1.fi/security/2015-2/] (CVE-2015-4141) * fixed WMM Action frame parser (AP mode) [http://w1.fi/security/2015-3/] (CVE-2015-4142) * fixed EAP-pwd peer missing payload length validation [http://w1.fi/security/2015-4/] (CVE-2015-4143, CVE-2015-4144, CVE-2015-4145, CVE-2015-4146) * fixed validation of WPS and P2P NFC NDEF record payload length [http://w1.fi/security/2015-5/] (CVE-2015-8041) * nl80211: - added VHT configuration for IBSS - fixed vendor command handling to check OUI properly - allow driver-based roaming to change ESS * added AVG_BEACON_RSSI to SIGNAL_POLL output * wpa_cli: added tab completion for number of commands * removed unmaintained and not yet completed SChannel/CryptoAPI support * modified Extended Capabilities element use in Probe Request frames to include all cases if any of the values are non-zero * added support for dynamically creating/removing a virtual interface with interface_add/interface_remove * added support for hashed password (NtHash) in EAP-pwd peer * added support for memory-only PSK/passphrase (mem_only_psk=1 and CTRL-REQ/RSP-PSK_PASSPHRASE) * P2P - optimize scan frequencies list when re-joining a persistent group - fixed number of sequences with nl80211 P2P Device interface - added operating class 125 for P2P use cases (this allows 5 GHz channels 161 and 169 to be used if they are enabled in the current regulatory domain) - number of fixes to P2PS functionality - do not allow 40 MHz co-ex PRI/SEC switch to force MCC - extended support for preferred channel listing * D-Bus: - fixed WPS property of fi.w1.wpa_supplicant1.BSS interface - fixed PresenceRequest to use group interface - added new signals: FindStopped, WPS pbc-overlap, GroupFormationFailure, WPS timeout, InvitationReceived - added new methods: WPS Cancel, P2P Cancel, Reconnect, RemoveClient - added manufacturer info * added EAP-EKE peer support for deriving Session-Id * added wps_priority configuration parameter to set the default priority for all network profiles added by WPS * added support to request a scan with specific SSIDs with the SCAN command (optional "ssid " arguments) * removed support for WEP40/WEP104 as a group cipher with WPA/WPA2 * fixed SAE group selection in an error case * modified SAE routines to be more robust and PWE generation to be stronger against timing attacks * added support for Brainpool Elliptic Curves with SAE * added support for CCMP-256 and GCMP-256 as group ciphers with FT * fixed BSS selection based on estimated throughput * added option to disable TLSv1.0 with OpenSSL (phase1="tls_disable_tlsv1_0=1") * added Fast Session Transfer (FST) module * fixed OpenSSL PKCS#12 extra certificate handling * fixed key derivation for Suite B 192-bit AKM (this breaks compatibility with the earlier version) * added RSN IE to Mesh Peering Open/Confirm frames * number of small fixes- added patch for bnc#930077 CVE-2015-4141 0001-AP-WMM-Fix-integer-underflow-in-WMM-Action-frame-par.patch - added patch for bnc#930078 CVE-2015-4142 0001-WPS-Fix-HTTP-chunked-transfer-encoding-parser.patch - added patches for bnc#930079 CVE-2015-4143 0001-EAP-pwd-peer-Fix-payload-length-validation-for-Commi.patch 0002-EAP-pwd-server-Fix-payload-length-validation-for-Com.patch 0003-EAP-pwd-peer-Fix-Total-Length-parsing-for-fragment-r.patch 0004-EAP-pwd-server-Fix-Total-Length-parsing-for-fragment.patch 0005-EAP-pwd-peer-Fix-asymmetric-fragmentation-behavior.patch- Add wpa_s-D-Bus-Fix-operations-when-P2P-management-interface-is-used.patch Fix Segmentation fault in wpa_supplicant. Patch taken from upstream master git (arch#44740).- 0001-P2P-Validate-SSID-element-length-before-copying-it-C.patch Fix CVE-2015-1863, memcpy overflow. - wpa_supplicant-alloc_size.patch: annotate two wrappers with attribute alloc_size, which may help warning us of bugs such as the above.- Delete wpa_priv and eapol_test man pages, these are disabled in config - Move wpa_gui man page to gui package- Update to 2.4 * allow OpenSSL cipher configuration to be set for internal EAP server (openssl_ciphers parameter) * fixed number of small issues based on hwsim test case failures and static analyzer reports * P2P: - add new=<0/1> flag to P2P-DEVICE-FOUND events - add passive channels in invitation response from P2P Client - enable nl80211 P2P_DEVICE support by default - fix regresssion in disallow_freq preventing search on social channels - fix regressions in P2P SD query processing - try to re-invite with social operating channel if no common channels in invitation - allow cross connection on parent interface (this fixes number of use cases with nl80211) - add support for P2P services (P2PS) - add p2p_go_ctwindow configuration parameter to allow GO CTWindow to be configured * increase postponing of EAPOL-Start by one second with AP/GO that supports WPS 2.0 (this makes it less likely to trigger extra roundtrip of identity frames) * add support for PMKSA caching with SAE * add support for control mesh BSS (IEEE 802.11s) operations * fixed number of issues with D-Bus P2P commands * fixed regression in ap_scan=2 special case for WPS * fixed macsec_validate configuration * add a workaround for incorrectly behaving APs that try to use EAPOL-Key descriptor version 3 when the station supports PMF even if PMF is not enabled on the AP * allow TLS v1.1 and v1.2 to be negotiated by default; previous behavior of disabling these can be configured to work around issues with broken servers with phase1="tls_disable_tlsv1_1=1 tls_disable_tlsv1_2=1" * add support for Suite B (128-bit and 192-bit level) key management and cipher suites * add WMM-AC support (WMM_AC_ADDTS/WMM_AC_DELTS) * improved BSS Transition Management processing * add support for neighbor report * add support for link measurement * fixed expiration of BSS entry with all-zeros BSSID * add optional LAST_ID=x argument to LIST_NETWORK to allow all configured networks to be listed even with huge number of network profiles * add support for EAP Re-Authentication Protocol (ERP) * fixed EAP-IKEv2 fragmentation reassembly * improved PKCS#11 configuration for OpenSSL * set stdout to be line-buffered * add TDLS channel switch configuration * add support for MAC address randomization in scans with nl80211 * enable HT for IBSS if supported by the driver * add BSSID black and white lists (bssid_blacklist, bssid_whitelist) * add support for domain_suffix_match with GnuTLS * add OCSP stapling client support with GnuTLS * include peer certificate in EAP events even without a separate probe operation; old behavior can be restored with cert_in_cb=0 * add peer ceritficate alt subject name to EAP events (CTRL-EVENT-EAP-PEER-ALT) * add domain_match network profile parameter (similar to domain_suffix_match, but full match is required) * enable AP/GO mode HT Tx STBC automatically based on driver support * add ANQP-QUERY-DONE event to provide information on ANQP parsing status * allow passive scanning to be forced with passive_scan=1 * add a workaround for Linux packet socket behavior when interface is in bridge * increase 5 GHz band preference in BSS selection (estimate SNR, if info not available from driver; estimate maximum throughput based on common HT/VHT/specific TX rate support) * add INTERWORKING_ADD_NETWORK ctrl_iface command; this can be used to implement Interworking network selection behavior in upper layers software components * add optional reassoc_same_bss_optim=1 (disabled by default) optimization to avoid unnecessary Authentication frame exchange * extend TDLS frame padding workaround to cover all packets * allow wpa_supplicant to recover nl80211 functionality if the cfg80211 module gets removed and reloaded without restarting wpa_supplicant * allow hostapd DFS implementation to be used in wpa_supplicant AP mode- Update to 2.3 * fixed number of minor issues identified in static analyzer warnings * fixed wfd_dev_info to be more careful and not read beyond the buffer when parsing invalid information for P2P-DEVICE-FOUND * extended P2P and GAS query operations to support drivers that have maximum remain-on-channel time below 1000 ms (500 ms is the current minimum supported value) * added p2p_search_delay parameter to make the default p2p_find delay configurable * improved P2P operating channel selection for various multi-channel concurrency cases * fixed some TDLS failure cases to clean up driver state * fixed dynamic interface addition cases with nl80211 to avoid adding ifindex values to incorrect interface to skip foreign interface events properly * added TDLS workaround for some APs that may add extra data to the end of a short frame * fixed EAP-AKA' message parser with multiple AT_KDF attributes * added configuration option (p2p_passphrase_len) to allow longer passphrases to be generated for P2P groups * fixed IBSS channel configuration in some corner cases * improved HT/VHT/QoS parameter setup for TDLS * modified D-Bus interface for P2P peers/groups * started to use constant time comparison for various password and hash values to reduce possibility of any externally measurable timing differences * extended explicit clearing of freed memory and expired keys to avoid keeping private data in memory longer than necessary * added optional scan_id parameter to the SCAN command to allow manual scan requests for active scans for specific configured SSIDs * fixed CTRL-EVENT-REGDOM-CHANGE event init parameter value * added option to set Hotspot 2.0 Rel 2 update_identifier in network configuration to support external configuration * modified Android PNO functionality to send Probe Request frames only for hidden SSIDs (based on scan_ssid=1) * added generic mechanism for adding vendor elements into frames at runtime (VENDOR_ELEM_ADD, VENDOR_ELEM_GET, VENDOR_ELEM_REMOVE) * added fields to show unrecognized vendor elements in P2P_PEER * removed EAP-TTLS/MSCHAPv2 interoperability workaround so that MS-CHAP2-Success is required to be present regardless of eap_workaround configuration * modified EAP fast session resumption to allow results to be used only with the same network block that generated them * extended freq_list configuration to apply for sched_scan as well as normal scan * modified WPS to merge mixed-WPA/WPA2 credentials from a single session * fixed nl80211/RTM_DELLINK processing when a P2P GO interface is removed from a bridge * fixed number of small P2P issues to make negotiations more robust in corner cases * added experimental support for using temporary, random local MAC address (mac_addr and preassoc_mac_addr parameters); this is disabled by default (i.e., previous behavior of using permanent address is maintained if configuration is not changed) * added D-Bus interface for setting/clearing WFD IEs * fixed TDLS AID configuration for VHT * modified -m configuration file to be used only for the P2P non-netdev management device and do not load this for the default station interface or load the station interface configuration for the P2P management interface * fixed external MAC address changes while wpa_supplicant is running * started to enable HT (if supported by the driver) for IBSS * fixed wpa_cli action script execution to use more robust mechanism (CVE-2014-3686)s390zl33 17418901492.10-150600.7.6.12.10-150600.7.6.1wpa_guiwpa_gui.8.gz/usr/sbin//usr/share/man/man8/-fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -gobs://build.suse.de/SUSE:Maintenance:37861/SUSE_SLE-15-SP6_Update/9b432eb1227ff88675139bcb07b9c311-wpa_supplicant.SUSE_SLE-15-SP6_Updatedrpmxz5s390x-suse-linuxELF 64-bit MSB shared object, IBM S/390, version 1 (SYSV), dynamically linked, interpreter /lib/ld64.so.1, for GNU/Linux 3.2.0, BuildID[sha1]=d1148925d3f37e0b3d7f49e3ca494616c5584145, strippedtroff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix)RRRRRRRR R RR R RRRRRR Rl;v5^Dutf-832292edfb837bfb1842856b0f77dd21e8435bcd3bfbadb3b565fd27fd15cbf64? 7zXZ !t/c3]"k%{m{#rD~d tGJf͚tvC n9Ad^&|Z")g\Vz44jMb(xYXiI #%l(z H }%ϩB3zam@fQl|F4cdliw &~0a΋{hPM LS `u)P֟KuxmV>˚Ԗ=Wkcg?mwƆ3A[EV9잃"lopF٦es&C7:7|t / b>'gayҜ-RHĞטy' _ԓ5D8%IgbY7#q#B&90-د“_;/\} R(eLVjm]xP!!d32g[GQI-cWwՑϞϛ6$B;m0ˠh#`9{HH!-aGV7vSz޿ j$*De$qtJd0-HD4S0oجx.ј'(ՓJ^zUH0務Oub')GudtvZ+C!J| @6ÚB$,]3'[o#@2Ojՠ&HᆋD6ڱ9v+j;7q)xBJ}&/)I݆I΄Dbb3f%~: qR\qH1R-DI{;Ht:6:mEH?$+*)$'f^;$/ɔ/'H9@uL Xլ:yuc6%&n*6{rk _[EsvЇ.` q v--pY!msw!!&j' UO 1F '{ˉM5NƢ I}iv-.UT_` |"MJ_P.2t+'zơOZfeMݙ; 7BG{C ^X؃ 5T,ޱ0}O2LE*8t$MU{Q2eqc\p,f?q٫"2R(u6K)!f>^b'һgY 37e~x\K_yVTA)Cm* sN peŰ>22YǕAG0ӔɜwӥNΨӹz 0ך*,%_]Uw>3 !`-/":l/rf4Z"{|о)d_|XE#Z2=ʬk}VU~6=%٠5G`lD:HY "?e73:0-pұ* "J~x+XE`NXgz1];M z<]foRǪuvPuceX켭4N{G*]*O%8]PwѲ&+~wa þgSW x>N_+٩'$ yo{aq#QE^fzʷ|#]ﶗyOh5_X|F HUZ8Ox$k~mCqv=Z6,]ըy6fri^;f\ˠ仦B֔:_A!vp_._zrػtWůÆMYFiфvQz/Y3,wXlkP9ʧFOBdC9KG,GIH {r $S*!dgEtFRE0q1 >V̤/ڪ#b;wKrFKxkx*٠@1\f4A3Э %DT ݔ&'ϔ)Kz,x+vKg5)[NZ@Akؖ0vHP>e+1Č .%[ni \fBSF f+XL 9 :C)Z)"vgT:ߍbrMy6427lXcz;_AW~L:w;mquuv*UZfc J4|oy+8w%1=SW7# M{F֣ެoa=xf uĜ߅y(NRϷ/9D?LBͤjv<$*n`Ӫ2fXmv9ٟGڔ@`c)F$@g+bKV)jb )ß>;_GވM&nr(^< }4zj_; [ ՁQ67g- uk%i3ut4kԤõ^xZex*:08<b =jGak=܎Mi湂ߎ kl9)x`mzJOݦE& 61j" $Fk)@zB<:5GKV1Ue4dȃ>Q;"םD7u'uQUUbthhz*zZsݝ`'6)|;9֏DnMƹǰV^㐐~@">biWvT/j{:v+hm#o{{g1_Od48V%Z܈f 'c(K6ht1M *`dCdb-;="q4Ҝ%[xJтr*0 ʻOf13zLϋ yUlF_rRG7*DKS XRR h$ l}KRj y@sJ|'VkVTM|-**aXte*ݯ&km*-=fCAl}F7R1YO]`f'LUdmr"R|?(&D9SB_A: ȉ̸. ѸͰ噸>OfN]zdkwQ X@=? o莼ifSbrV`fywM%]]􍊓aHGQ=Op_MOY) ;Qڳ^JU+1ߙ$~(3cmsCcgDuEe ¸z@x$:a/6dəZb#*B~Dg= CMn* ^qӥ&M8kK} E ;0 NEC+$Ό~n^u$iN,mᅓ3dzgzAV0 ;$2݉LuOTus{u8#lQ_D^j좕ÎK'Z$>2茈l} g=*QcUB̟ ]tRʫXI\Flc{987F1?I4E P^an)6 eXĦ޷|e]z4tLA]+ 4LWzEj v5h3*>ae$ OZ A S50PJò!VobWeEvsz9tB%ĬW^e@VNK3 (Z1;W(D^#Uy+o;(;>^!7Xx<[oX.)}N <12M'oY;tYYnZdW8nKgI wAQ{84oHOM"m]4ХZ|+yğk%*}fuH k{%U~`ed[㭍+~x5 Z`m̐z\>I$X^GOaNW (l`VcՆgWy`"r_I~Eph6yi#>BN8++d[vqMh@.S_$x >Q)&ޡۄA^ m75^|GT* GCg\ ýv83Dh #_rqH6r>yUEp1⟧Tu3NDNd Gf`OUi|5If2nN"UrT U£`zjH{f,P@C,:k뙯cVUT's_ܘv hP9V7AJ*9w`4*Xv+X <JD A1q>M|pjܩ5xyWeJFsTWf(xQ1U0zhh(Qs[Ϻ^\>g̭ 9rYҫ|Km V+v'zhHMYT\evѱpa0*>2B٢1Ln`ɪA_f_}S{%|Mdgs$0-F>tKWG~e5aܯ eApp3Z PrK=>G,խ@F IHI8^zDQWdĿW=h{bZz;\+SaĊ{9AY'4xTQb ?9*pV˴cK#@YBp$"Sزf屶{M)ߡMyxz kd7I0zH"mur :Zx>/^֖Qc @yԪ `袇N2^7UsGYV" Oib s{VΓ~˰i%WkH \ |,lOR%i tenIz :ԻwIiN؏Vf?CYp4Pш0!YASq*H5|$d4mqJp˯HKy^Z;?E%A~L;f|!|L  rXJ:K]x&N>:_QeZnMni+xS)b N%2I lՊgfPQ^i0IJI)62qD "O L9>s-8ՌN#ؐni|NbWx7 )<zd' Z(ANʮ]F Q *TU]1I[;OԸZ7Ę6߶~"ACqeWbI:-.5C6YPld%A(Wn;L%9ggqtfUu֙܋TwU\vll~8 FIx$Ҷoaj{lVQC ]KCi'HPjڷ* STrVb>10I9֮ut !Rka=zu-ixZR?Oe= LRS_$iL'Du|vXO}Ax LV{^aݖ@ Xn:/Vg_%-5f ZQ@yg>NDE!cլ..'YЄ(6n*0dc43슊 d/*ӗZHփ36ݚld)Uj,m'B՗\>qvL]i~E74߄a+xFBLJE ژ;E"Ht_]+#Y,ʪ8-I'MX4)ݿ"\/wEFTnǁ6%tKʂkk3? = 5hd- X$CF43F/*Ҹ6aw3>XO&yK R6t$=-DYl S2 S/ |<ɪ6 zQCi4]8CƳ) Rwi=|N$;  e#>̏i ~(| :$8S|y-Y]=)eF?KSeOR+ͅwU-41Ţ]ߊQ!$:E,JH{%_|,} ?2጖[QtrIWEwí3/ /}:##VZ)^6v21לwS9>&2Ys wH8KY vk [|P~@lOUw FV?]<qٱC`0tՆY 3m(Swvڑo׫zZ먢;:ID[p;Y7ru/a< Tp uDB/*#0ZYnnrD)z" ;"Jc"{ 4RuXC=aNQgƽg{XJ hO >~5qK%pA+Z'Z odbm6Vl9@Oa]|fER?`*Hx&Фsh'y O,/Y t7/DBleُ;_@3't V%)XÜ'8[ް*uч2}> ~E4~݅]) }JӍnK4kEgȐv KЛPHG4_n9Pzfvh|'ZgQ lwkpi!Hl424(Iz'zIk"B ſT!2E[ͲgYDb\h8C6O_hp5/1CdDL(xG<8D!g"TTk#q bnnGoQD(SHAUaX*Z8I,e qzWD^`*;^x6!P嵁L@=x囬Qi\;=;H=JF5*hm申s}Ep񫴼dd=k;qM.[i g59("(#ɑ9i#l uV<ha7x2v 65diey[h[(Dqkx jStXk:~Ԧɐ uȾc{Y;=VS̈́],"3>{LrhΑ-# +|~DtcHxVML#([m49GtLܖYb?4ϑs\M!*j$>^NչƝ{`E1]y`иVA/%BoVkBJgFVXS7R2s UhrexoZ{ ˑks$aI1'WK+Ah]⪺@i+)LpdU}\Fi|U@{Dj+?%"ȚexYxu ^/(V&staeHW zd8#cg0\+Y HE2dc J[^VfIz?T8磲g2zF5$f"sD/IJtBPr`BoEXFE`n}0<`a75Q( ėoh< 0]*'HrʙuWfKB ,'|aG@ V,{<0Kܺu_@ȵ0:b^ bgb@tD:ȇv51 tu$UmQh"jmBV/ZGW'XDA_VyLs c׌?s^-; C|v•n\␳IRe=$Əl@c 1N'}吂9&c^iq`v'݀7S,YKXJ4%О;b6}3yH D[.[2g႞dPkY3e&tSRr a­-v1X DgªGeD(dY+o ءg/ -x-m$%U~ԥf32\C?{{8x# vmqE=BG|>L|2}kY_\?fCx:_ΩEІN\Q/_`Xd}3PvhSB2Mr,eH, XP^c(Vx(bunxAQYL xhhZ?)kLlW>7,~/:Lux 3 /摀f'KJ K<(jM)t$d^\' E^<5*t\k|f:jm86# grE4<@)*kcNZvD4/6q \٪ͩΊב?'OdNL蕂ޅc(q߅|@'aP_x"w_МCɾLDU$1(u8s xS#p¶].OPmQ]P0#:5g8 "^621E(/ce O<o-UBb)̊ ؔ)n)C~aL2A%:NpJ7Fœ+@esT DFl<#B\R*U*{PزB=M'ցL@_IZHziӾK|U )_NLR.f{ۏFUn8Ț!ޜiɀ4.*FoQŚJq꺴rR72DH@Mppx'4GP~1iʕ͊![qBFIsoH{Yho.B1;^V d. MS}ZZ@: [:o@2ӵ>\TdHpN-W7qř'+M;G$XXn ^"B5ԧ$H?fLے`k FP6gˎGm6:Զ\fylVV cc_Z%j)'$M:&UR8kcYP\X uY9 r+hS!D^M!?D0ղIU\mA*n GsCEs,"$SE$G'R;]XJyS JObxNaqx\!B V(;k2 7ã~IClj~Cw!-dz"[o}: sZp0lakTYR;vE-)>}h6&8犹NTg؜?k~pYlp*`#U.ض, Wo!C[0o-DTrzjN>fݓrLm ~" C3% S?cN1*ǧ/ 3JizqF&9GiN>@2 V Zf'_)0[zwQP_נN>׷@mB%4YYi|?m}ӧ'4`!C#I`v!xiHuktm)ī0w+;Sg{\w^ɬt 1/7-Nw ya8ͭ TqanTټ_7\O8c/}l:[wxnԶŕZhOCn< XM4s|q12. S[@$( t9@Wv2Ci^9|oU:jDO'Vw.CkJs4])iC==NT~"<*u%m}NG6˽FUX OT+B]6Jy! 5ّth@ ˍwɂ=leJN)2JܫN_sC XʯY"js҂k_u>n4faEiBѓi@fF[mA0.1SDjk?,)vۅwwh;YdHLlhV6{E]HM1"+,o'`ӂ &?}9jHeG"VAS =sI6G/ ƻ;%Dܚ=uxJ( G|—>ҰXzv%GR!z0_ 0Eܕn[U.8+[ &ևѐ޸|HEͺ,=xU8Irhd4l^go1dw0^#(9D~x Vغk [9:әxҠSr⺑qG0|& 6}eHtٱX@9Ν@GE0N~xT?>J Jۇry@L;+]tE(]Hv1~c}^#|f `BP]P6ɬDlhGlgiYe7춉LϗomaБ~W>+C+0 ~^Qzn{*`쓕#BC$bq8jMX$OA_K#CYO"FqNw.l;A$r S㾒|vHN,ZbSo2jQ*XӜޫyּtqr>v0m!:l!8VDf`x"޴Wu Y=8Ȝ?R}wbztnV4'Ǜ$dme&!lU {Ͼ2g<&e,i0Ww|۫)㞋$L+k<D&ɫqX 4qH[]KPz6j];qbeiD&W3B˦FkM8FyרM3|faxd <ǎf' ,b-€c~a /4A&%dQ"ĦO 8%I^6n%V-CA;7b9 77+L^?Y_acZ^nQٓ1usr+ orCt9k!*٭L9$MՀW5)k#psAUe܇.\^K_O}-V=zȩۮO06hׅ6 H~Ӿ]1go ;\lj:8@ƹ@ʛuTxuT8dv9!eʅ;ܽiwpXQKeBX乁~=/9jy}08o T/\wWw7{ۡ/n(g!Wgr@@~}&0K3#Nx#R̺7  [@;F?]%cc:/*VML(.۩DU ; ;Ube_FSՁ_#59N.V(ξ:e\ᙀuhN7 ;wN""$ܛ{` ܸ *2ߏ\QG TWE#ǵxrI^|E k>ܷ!jkKv>9},@9~حw՛GJ1Hx7޹lCJ<AwOr5"Az#?Kzr(emĔ06jr18Ѳ?P6Q 1q3:;jjn1L7UHCDyiY6kar~. js%%sb}xfa#ERx&KNӭNb8B+%ԭқׄG ߔ>}zn1hWQ/MDBrA 0.<ݮE|McʛJ٨@Tg'0m1;h HZg_Z8;&,չ#C͋Fp6 %0n ! DZv惸mdT$1Pt}NZx3c`tv66pщ_ǀW r]>]7.K'e./>\CŒ6Յh z fX2}^WD##r I~#m+g;8BIPP z.g}q2TǯMgF]qA=Q"=b=!dZ-1)*Scq- Vi(11ʇC.t >%+D؋o-6_JÕ!@mԬQߙnA67Jos_#V|~0F 2Udz@'sr .lw~Tha"ZKqwE6U]y I9!j> Ra'L&Š9(2uIH^Y@/Q,+(A10|FNWHC U< .,LG>Zq9P](smWPQvqaO`J:^KL]TYGmo1S}Ed-#~xIVHi޳9mu-> *D; Pz}<=Z+e8<]__uPpM0O<3[z }>GCOˌ$zNXď={[MJ;Ưv(U`xLs[ Icqd6O*Bk֫m7]Hu*,^3aQ|Zyqrs.pU.m30M|8 q;c:z=Ĕ)*2!3*,DffT3ܓkWI|w3Uj"Q B hʎ'!MuBзEKH$yvCInw Ԃa$ol= xdJ_mJs@GO_y% X^WOXLRX~5MѤ#]هOOM.zZy( 0C} a,eXn}!r…>>jBO\(>s} $[pj?A,V &2bL{Ȟh)AZnC2͋uٓQt[oDÿ -9W'+92h"ԺqkdǃĀ/Tg6pϬ&/goܷ;@So%X  KWPy\W<w49Ņ69rGf 5/LL'  ZoJ4pmL+aNZs}d*u%V2 gҍw#"J .v2. p|/>p5|VUbt p/cW1T21 @8xSM.%O+VR? _ lm}{[eozs)xlm#јbRÂnY{ncvnLh(ћtu%!^2j$V n0P<*ūrm~  |4Ķ k.)_99zf&FFOOߞ*f@ۮB>$SҼ?cE֬\}-Iw/œT͸J?:?g'}sppi/ecB}T]Ą&(HRܓPI^WKoݠGk3./ Jj~T)PҪ\0rCz^ Ep=1܅?P ,l<x 'ntU2,Y>9Zގ@e=Z8g)=A*W u7rcծfMZ"\'G+ Y4EVivO\WvbϓQ#ē7~ro4Kj4)I} Vi"O| XrYܸm!#_lMY_ M6~Z^Șj#C[ /&G|F7 @^BQ+=O2}}l͢EYeUv@h!@BAE}3_J?TN21Kߠ,!z::m +he`%Q$= 1+GE)` Z ĝF#R6ڕ9! lY.QO%+'ݼtUZݵ'%v؟Hq}N=l5͒ R4HSIY ƺݱ 5=e;>֧_+`OG0pU۬iw^VЋbm?f4x֗(&4FWt:nA <0\c$gIzR_NюU.^? ];Δc>hg@e*hvRȻ|{"al;Gtvx#[H':9/!uO5v:mI֕rZ= )N'[Dmcs2ܞ|F R jO/JX8 MX82,jq,|P?6 5蠄Y>820/S+D.,b}zz/ A ?2\cHx 667 m :T-hbZbo - bџ_Q`7h v5[U3QxTʞ?VV@SbI؄[]Р%y3ְf?y_Tf&i&Z6qC6 /.jو l ` µ-'I@;|;yy@$Qiqp GycYf+ړԖN e!mIDWL{<%s<W6۸ 4?{ΞX <&Aw*nM>UAQ)mjmuƬVe )Rvl-mP6\TGV܈ G+#[ŠKrÜwn?"q̓m}MCF򢃌Vqs<; kOyP9&.WQ.ݽtfbAa_u&@ЇB IhjL)O!F `4@*ͺohxiRk;(@v]yIkHFs`Ϧgs wď wqAuz˜OF98K`nG2RR2nkqh^VI2iNZ^$=Z*eM5s(J[T ?@o q#}Sܓae'A>2T*>ikWPQ0LbA6( "lw0 Mt}܎^gFׇpS@}vJҳx7|3 X^:@E4a54|ͷW;{<{bY`~¬yRa (4j 0HádaBi=Y+]`m5[J1{_sy-9k[a5xC{8/W+Rh^\dP͹y>\Ϭ-jȑYw?I^,.r89, j CE `Sv"rW٠F2J1\1

kR{a̟-Jc įXu#B3<dᡕH%@*C9FDy+gAq[Nv]E0iEiLimh(hGOkZGfx%Xd[T>ŷHdE}Uf|d%NS$?ƈ ],u!:0+P6Cv1zu;[ QrYr~׻ Ft0eq` zLC_B~Rw]VhGLI%WODc-V@NW}kYMqJϕM:&CFm! =Lbµ& Izy; J+0\!M!Iq\rFJE֜p__Txܩ$vZPrmRn)󵫷bYx~[L Aq-HTJEJJ3(L2`!GZR'WYbQNvjE%>u]6Js b0\yZ9P/4~Bbi3*MjԴuʰR(b"ke67D+h@>Y.0)/]~b m_ZFœ*ÿEU<[ =|Ya=kY KNUi+i&)5 ʹyYtzk6xH_iM_r/g%ydOu'0Pg x՝۷Dh6'bV%.\8Go4wy<^KRZ\Tf5> EEAʯ!f sq ("y@WzΎE/frp̎pek8u_z?I&28J+'n3 Z2gK0h*^l'K$n,-+"{|A/wkj]+ZŴ#'M~tgUv\Y+ohô:,S"r%F#*EVqmD!T˙,X%]^=eUT"785$x>cryR"DŽMoqOū^7.|nH@?ut / D'FzK蛭+Ȇs}M:22ctP&9Ge↸ 7ᝍP&x/6juEF~c]ՊNzI֤P{J=G3)R0ilj34zϤbW`C$<䀕+|e9쮅%S`= A"U=ޏ4FJ@{M}BfOJϚSFkb=G5؟~tOc'5Acl~qvuTkgz̟c\䙓\e󘟎S􂏏= 5HW9zH^`jE3*]sS ajl,_,\y^#EҼj0?mW7,ߺy#у:NNi 1G4ʌ2DԩLׅ$?<~)0O<׍l>5!6}Q  IN=dl;T@~ YϕN} YG& ' ˆ"H;X.c DA9>{T%M%q酮E2/煮HtB9q6∙ql7r!+J+4p#A|Xn+¦r 0v0(u'Pjq.Ηu>\txhk҂>fmd)Nh/zS&d9zR#/uFSH3t7w^? 93%es S' }L/JJsn&εyu ZO}0 UDS D?+i怡2\W_grc>L0ڨh{@~q b:E~ZfWZE Zr&aۥo(pɩ)aw awҥEC !i{#]~'SRRx?X';{hh " BVñ\cjBWp?!o}х#4c0ծd+S8Áp' x6Ě*YsXHL1,Q?Ϛuўv5܀E,u@a&g~ONWF4^pp!_I\kFnh8v Ո \!wVkE(fʒ=TS1BՋnr?|~*+p:d &vlL^; oSe52"@ Xc8tr0w(8yc.|h)oK6d(ESùdCrj}I/p6h*Ӳ.̿Vފ*58"fJ-"`ڝ& y#.Ti`Y EСK;Nn<;K* zk,{y fhIMyBB2$v|EgIhulTQ&-ckp n H:5?rWohC8&=<1aWP :ģ&e$+*W Sv s^'KWa{lRxeM+`2L 2?I1k=.WXbՉ_ i}^r«]*hVv|Aˊ 5WSk1)9/^,}+2q悗WN{'2M0/_g&Ȍ y)`z9dfB@1PdPB<r!DiA<}s-hDҙGMO' zyA+# -K*C_E1NF7Yce0[IucLN\əQwoq#u:y\oE #t-_yYda^EQNolԀTTl3)Ҋ|<ѾӲk8OiyQi֚Һ]{.6nC  _NSj޲slA}a_^K%P^3[AduJ-ۊ3Jřpz,6֦=>"ۘz_;bXK.nXx.hج i0h )Go mF+ܣ߿+vzZ fbY TG =;5°:G7LCL҄#^Jsjnpl^m!`dH*v?&qy!1_75,D,tɞJp؁i.]s,fK;ws+Zc>gգ_?rUiLo{,xd9#x,a>@ƲBK|.,zi?Hd>GgO`{n1{ʌ$ 'o(_0KiQܩ{#!#F'7^) hM-hC_Dzu)SYσ8x +9;݃lV`@ɲW p;VRE>TG2_YLlO=l"iY6fXF2r`ln9!@}dY(zǫ+tw4l3Yۆ+n=E^xb+ʆ똇G v1=%wf%cՍUv]Ih2v585J&9O$qSv8hkbJ/LAmt7sOWVC4 B`ytlMy1Im 2""*Gы:S]%L7%Z.&HDt Pt?P0ڧ*Fr1GH&1W. M B3UMM.Eǫ̒ei.6"˹5mZ?tda#DڊM_]$J3nEp*?9( ?SQXzQ{eJ*p /o97!GW$MWvDoCfh֪1DYOi.?n  x}+RظM2xO`f8PB̿Cq*wטߏKW m&uB^PB&W=cFiHSRw P(W֌X܇K{nwze{"b#ՕJz-{Y`CVH[,M)`\7~]OԧDx~%ED4 P\yzQC}Tk5O8@OfbjJl 2XF=d?%P=b<꒞wm9B m0Ng]TD}ցA4U4кίdtB)*iX3VѬbY~J v-rXM^PL ]d4K,@oxY=#2|cրr.C/=<auL^6(k!>O(SSNGzݣ5a4Y@A qҕP.1}2[ALʪ^&JJhc e>tcyE˗1JNˠX3hR1]A=\l:7K(sdl?j\akE}hVͨI;E)g|/ݨ ЬAD-D'ʧlH"( HjE!nϭsAqD({P XT-RrxOm 0Z/u )$yyjHVV/Lř␝WYlDo'ԇugnޏ?IoG\Ɨ{ N DXѮKSCDo}$<&GF\!բLD-$*i&\'v$=!!aBp6o@h轳NKmǎ/Z4^p? _)NRe`ȴ\@ &ԟ}lb}8~YZ[?*蜂vR[> K)Gvn3JF$RM!:^sf;r$9\^R7WRF8/ ;ɖ~%G|&bn9Skx^?.1)|3=h5PSlf%' e1y + SH7M5B(OmwG*W.VL;rJ[|4n~O1yN-g>Q r4T_;\yjeOHa2Peܪ{o8(E2ÙĎQ`MmW|@oq+)ShMu|B18Δj3<9™(! O$3mָ<\^)l4V"y}-7Gx *M:ڤk;5ޔ"pgQ 1CjULRø?USQu}9I'ء],HXꑱHmZ^e(l0ܞCQ-M So5;-IXId)w ߝiIr0 ⒴MJ4Ivä9|0K3( >oY&n@\;JDJ/`JjH]Fծol(kKC` 1pqIo+'|_)Wd`kr{NzK|d䫸]sO]71SD.EnvGMviԒc5+҈)".ZB*v=a=MCކ?Hr8 G8 Tu^8vl*__.MѲvnnrƮ/Fsݏ&mRG$=*ëatbs=el1NR7"zb3jhY xp+,Saxh{IC@/"TsGVo9uyKX;{\P= ӯ8+%z@\γCGmM\,6{g9X\?R|h7~WP/ęKzNӈ|i)T4o`C <4=RZNSr05;K]W#E̓.h<,;*0RJgTSPZ$Fز;rߊ\(FPv-Ui}ayR4+Z2W *q_g  npkн6‹ ܫ.N8z>V{.eqdT%H yd4G +č{vb-c@{/U)gTF""3$ڛׅN9^]89tl]2 CGPBx)5{ytЇ]SXڰwʀŻqU4ýU䫅8/}_r[~a ߵ:/;wW΍׷̮&T+5U*46^P8"hx<`ٳ] n2)!lBs@2UPH\E֧%j.o"*T+OGU9RcBl`Ǐ #UX5BIeв9΃FR!<讙2*\EJG9|SǗ̆3qiu\|@* μ'^:rw#CS yN⤜Oe>%R^#0+lN&͢L-еY17}tqɞƽ>n~q/*Ѫ}H+L:Ε ZtKk:dbp둗5"2bRPq>;sKܗ0Ct/^@-salYG[|CD&dW6+j,á3qCaPbmI5Ϳk,Nrݸ W"qSdFNU[dNImŔnȒGoPf!DF{/8H [.\zV%X' ?7s=[X-.C|A)׹| #CFHrX]ؕWm:;Odw2 M5sġKr'9UM5@oIlu :zAhQ5'w>R{gڅeZuqsk_@3BS(ub+-/bOd-fY3 "$O|*vq^qm |T>'I И楐2}p4]K )}k%6:/X=Q,Wg!>9i."):8"Ww` 6@9.L‡iDK_;#\g bf=616K8b_N+sӌ/;ekHʝ5./bpYJ0M0@1\l UdQ*Z _kV GG]ϡ#Lhdi:W4:!yĝŻ脅#/coE˿ixjW>])4 as:7>%~g/@Bn D3N<A;ğXN~H<꨼R}pr[Id&7S[6[eL#!ލIlyR,!噑zW+H0 ϬUŦˊ&Pi0cnZ;ltrԄ%XtDupP^Kߔ¬j>ʴD  II, I&fߢwU.Q|j?/2^{u"įuעeا)]D#D慓6qTjXY$ww4c8UX׆KiWXP6sb2$R&RrBswOVSpGŀtS>s#bZyĊR8Vsy Ǵ Q ˠܗiDDߧrb8ʢ,lt(pY/pYu?{C1=k6i럱ᛙ C}?t nQάyZ&bMPGJ&&BnYR)D=z'a~rI ][e<.IJ$Ai34s[ F`UO,uԠ{s՜rLͮLaDb}>»~\pi @ٍW9ֽK͔ub1Ѭ!3R3݇"Ed*##ܷY\ނvQɐ+/2 W|:qbI;rs)/d@)jͅ*\,AQJbU'u%0>2ی_=t"մs) ]|tWZ3#:hn~rkkܓsRS١`;I [8`Q~yL\Ī8+}3/؅y;TR}hd_^9S8%\Z9#T ~ vDRat @B mnD؏Ib37U&4c]Wm[ ꀏ`s"k?(g@[~)![O fB߆&Cvno*0gAA+ 1|HUG吼jL8D')Li2rZ7ְO :W_=^_n^YmzBr꬧TgF/r_fY!NE3z񅒓q|ML̟=  1Cg ,O^AP`&o:6@eB&dmiN"fk;ϋ*멨[+c*x$RB7F=bYp9)s{#몡 6c:^,X+>`i^vCٓ;W,0[#U !:M*y(ヲ](q̍wkx"u!ǿOLn裸+f}_(I !ʙ5DJiMit_"[s#7hɮ+XyT ଗϤ1oqbh9'P \HDt}tKG.bӖý%jԽ-~btT1j"Ov!>XȔb_"h٨^b;G4eL5;ZԈ""@k@$m;EL/ 3mE*ARH yqer1A-ba{ɿ]XhbGOj6Hn\=ώDGr{yqCknI UDDWj]< I*Z'F=Zb 2O/F{- 3\ om;(<n̐Ω߳7Vja>+.1/vASt2XR!z)%$sʆO(L#yfe7ɠd8M  Q]h'ё̪ٹ59bb}쑄]䢣8 ljFiZ8΄I>U[ W0U{$e IX|"^,f2q&rC 卟U?XH:*qbc2FY2U_ܤ\rh= |i cNT(-@o5 =xm3аM7ѣ|_Yup\Jp(׈Dq.DZۚodgtH:fO{Scvn~Ê [)\Qjh?~xr91 Y`Wϓ4.>o8 ȲAyLKmm:Vׂj<#6xf'|0)xnoح$8}ƧoW`7JfĸE]"Bj Z[=jg{ka!N#r}QHS\PlM%@7q7 0@"abIk^ʢ"l)]ⵄɳrW^RvR>X Alˈ6z&.khwHn K!yc%59[neT\Mp;Ko"ςǘ 5P~^RU+* udgiP jǠHzíxSJLՎҚDZQ9Wxt"7 qуUGoQ[_%MUIgz)xI-ݨo[h$3kǯHvy7!PJ4XRD )p+v=q]9K&2AS{G^)-߱ Ӣhb#&Fov`Ejwo:]LK-r$ex2z jo|^Ir&V9Nl\6lo ,;U1,{b &)%_ޭ*(%3Y!U O $90C95d W7*p D)HXº`6&BPn{jsDǯ;?Ln\طngkȳ|)VЗ^G&,'*ImH Hkp-wE:r7ٸ+^3^g!M,ep^b\,\tz9E}:<n @ŋ"7"gpXԻv K9 ܅JwX\w~U̺SlfuՖTl+vij7!#A4sfYR.>f E,pg+\&agW#kl/[u$c-X;@`ĊPdƓK,] ]-^Z$<ҵu{;p@Zwjz#RWW_l .j*yalMSe츢{v]xM ߠ~+e 0]?&0:_ϗVPΛ6R%n^6$S.,!ٛ:,w8 é-iM8 yH⪯^'ğ@nD7sq0#Vݲޝf+}]'Mjhs`^CNEĺI(*'-mI+a1ղ5AMWv$=|}#2ɪ|{ݭ9\Hڜ uz $(_=z3tUG^@TT[@p>'L'@ {ꓱ3$J$6ɩ:ӏJ-XEm.i=Wt'`vz.<Xl"}q0"vz„y\egj2~Eaw果s&FbOH2IIc锯9QD`ZMz)nϪܬ0>3J Fܸ02B|0ZC zo G |/@ͮ S=m,S٘H)ۜ rkHkWhV؃qCv)FB8B].+ӨY_IZS0' .PNDEr@rO BX>[iD0- ;rwP\kEAZmF&;zn>ƭEthجzںѳBJ7lc:U$ my,<ItY/E6~J 4$y)A>Jc i KGQ<μ҈7p0!3,Q%9IPw *4Ø9s {#c![\8mK?6:K9yJunAgnŗ9Jh b?=41'Y!Zn:GXF.Jm&;dFn8|YSrgB6@i{; 1b圉j ?ћTiTWꅆbc;H xx_>70~%V Gz9tX?l=IP6Q穔ũ%4q?2bea˛eŘ?;@ȑ^l؛"'ّR,xz/o2/2g[IN(؉m2LA/dU  `ȅݫnGHZ;G#Vp@mv]<[BHU7"y !H觚8fi0.[{U5h3jD#-H9}/JΗkHr`c0y`I'd\"A)k/pGafq'{l$T2ƘUܤ\)y^qi׼Bޮ_+Oѝ~>›=5֛ 3vmҿEbs@r\aePH5l\udc,#2\n۠b:݉P\`[NGw{wkgoDSFH{c)#M`A.LP[KfG ?;qC5#̪L]` 46 4/yiuC٥fV72 ;MTIInR-w:U}1zﻰ -nKK\^%Q&E $z)~ϲ"JrƦ6U"!ZH|-*e]T|@)U( #Sӎ#=@h|"CoA$Zemi5lcY6!-;3 b~=G>zj᝟# e,h;Lg)29@* 佌eXWp閎WzN{ IB⩻+rΌg< sMsh!Jރ5TjIsKnwd_ U:5 }`.M.AcT~v ׵̭4 b7) ΗtML>G"BnZ$t%2EsbJG9eB]ʾ]nG:͹* {{-0]ircfRL=L|>d:3N+ DJZ>u`a3-jaOM~ri7U޸> Y(rj#AL CgڬRQOS켒p(Z@MK&[% #]߅m0̦AUV\7Gk& nWyՠ`}B { -mAX27dmԠ Y3P9W Pu'|H,Ԑ:r6Իk~ND)( Ϳ¾\W%<u5zstJp0q}xӔ4fPp[ A;.1: ") .#qR>yh <F4p ; cmL2N_# 1W9@0iO7PX61M 7?@3c1}:$$ʯZ[o ܮF~)F@2.,h3U2 Rx&xa+sC+=h}|]JL ~k2Ejlpv+xs;u؎}8Ѣ|vSgk[jFi^ 75;{1ۢߋ q;7㠛}e48DGjcWeXS1#W#Az.2q _lgu!˙mRWA$l8 Ŏ"Lra `P@Ԗ:';棣 7O$b9UZe Us)xpCMp' opnq^ƈ10Y4km0ezTq~+$`]P;rI2BBEOJZTʱ92@_ΒHGcee Oj-ZE{S.!d[oE6I -K͑)")wT8838^+DA]]2"Yhwt %9~`H 5;^ 95s&^ 'B<tG s 0UЛ0Gep}̑^1_A2\qT;zaH[ }LC ?w  6.KU"^ kuHЊwǷ Yj)Cvh߾†<䓺Dq}0>8tڀqPĄHrjUk!ʎA pTa{X t='@]%At%%&B۝PYsz @udhBg6R{JF3i|%x=IP;?ޟqrݘo{yҮ}D-jTÁ12j$ȓG*)@5GJ6lhnmOIMf[Br-*d75T9pu9)N,&;&AdP)8bE:Ó.&nw`0uAb$c}Q7Г^`ŸWOg?vuV[2mB8D7p2aItŢ*N^ #qr紑yb(L,Md0ԓsG])+"顊J;m:2]Iwֈii.tK(#8bTϧXa?[y䊄B|YNBmX.s 1OQaxWF$=A( 2d8 aW2W`M#1~,_M`HV;*E>~YgYbf-򣻩;o o.^;b2`PeP3roND׆ .?w k!X H8I[d U`<ѫO^m >Nx䨞MwwF_fSTWw::c05p˷b0ط铩sb8nl] bT -<Ŷq$NrUhuEv <`hq#UP _>^J*ΩMPQ#Qj0B%dC6MQ5I/MoUw 7AyX5tSG-z)B^RA^=~`t%,N{(5i+29 v \J_*8[IՓ1;+{F`‹EDs훡j]sKh`9k% x` i g86"9z6KU?cY5j+erAb΃֡yitg(պP;E~\a ڭ{ eXE} c0 A#,Ryj-P܅ RvC=>Jx+:yP;98TY|Alńsp栁ن^ۙןxa)B0ID18^ޫCz1 /T8%JnY`Nh+#"rV4'i+'HhLLрL#:5(64K|baT6g;w)r˳m (C[֑/5hn.ק?^lyog3l2(ND`&` W|nda\Jh^mg.\֯k>% vR;@3q"X,ɲqW{ )bX$a0 &(u=c/MֵzqR9^YltM.'܌AK,} SNj<:&w? ثސE5|ھ׏ަ=ɠ,J8$l\nD#xVB"~)>}=&R¤8V3jW!zrKe<[^VcU tzWK%d Oߨ ®gCSnn_*Vb-;⢧֊O}:%Kz€'sU]Niw({U.9qa Cض*aB<sCbpכp~h2)ۅ:."8ѠhrMu*Y//3 &pwnQM]?ɤ">(Z5^|B6rx=U!zKN ( 1U Pk4*gO Š.Fr?wBL8E< v;XӸ%jF nר}'F𪑅C~#^k(^DJ,1(Kә]?io~@R(k Jl[ʥkL)olp_J23)Q^| IJSjlzŨ  lJ9'S9݌qPIT $zFlbEn '~ _:XϻWhi-+kڱv#ǁyFdQE^Td E0vFu#1W lm Lk;,^fU qS+oǻ+>hlH-h)v{:ݻN!d1> p`]&gtٺ0Sԡڨt_*!+;e&:x-uy0G7UΣw? |w'O$SR;:e:t;[ZoEVDU`IUC#kPJR iT2Fm ""7J`=snHyהs?P?+,'jp`VDca#$ ^wfܴ-ݻ.ST 'h :U|=&"J[9^3`C(p. {T3PΫ%2B+No_Y>FϢ?,֔72 :h3!%'gJ/҆4JVQ7Ѫ7+o7<+b2;<?#2Tcq G3rH$b-n(ܸNK\Α׽"䥊ߧ3\ /Jj} qioI߳Z c'-g6'Д[`0>bܷVͪ$e2'^ixԎ=\[y˚-Q_2c]K6gb Mgrq)_~:1{cÃ|v'|U ;ӛi&# %@ԀsxyϮXCZHk 46OJT@o^S8ue0k7/Twieeޗ[yX?%T ȻZKb 4ռMyc5@|^ 9rIC⤗r1r{C*1 131qM0:VHf`X:E O<2C.pf[k5@_I|±u"]=ZC* eLk!Erμdv;3Pk;D|gȺT?u#,B;4?e n;Q`|LKp2AawߖR VT(@~$^:7xRx B:`IsPV&A:/8v1KԪ( b /Q[;chx*~UtP\ytJ'"${[t̛/(%3AA1@I_z ( {Pz7W^ۖQ4'="z+*0!;u~U`w' ʇgo Eg> qu<.i37 pd bX1i 4`9Pb~OLQ $!a{,2 e9ˉ}~,8'ڥQ_tG6z/wwsqeF7$CrURP~n g!jAֆ".a DŽK׬5zGXnEN?B#CKzJYo؂]O5@9RH!S&yaTm2!x46md7?fe*1C~˧㛔7:Բ.f:_| Rt&cbmFߝb'jΕ E+23rfr,yɽ˓He]nk23\y ? 32Yql]lx"&@<9j[56-*R7q"MǬfs>B{5ͺHܡ ..¢Džߢ'R$RguRQ 9`2Ȧj}wl*'Վp\3c5"GHY$Ijd.T*(Wʽ4cīJ0f;,"h@_3/s:}~4s {KLd%m59K* o8䃈{ 5t>xIFSmF/Z[nf>(-w2qeϾ .9YYC_.]qj"PƘ=DS~5s,ލhE_9Tp KH:C鍚^zu,8}3};dneJI? Q1RũfϬb1Y BJpɲp3ASY4/Ӎ0 nA53tՐ14u6O; p. +[-"Y7@%#rJ'CX12ǂ8i-~ϗr KIC]9y34PIɌ'r`ާ\۵Q#;.j,JP¿S]{S3yqR)АsxP.kՂVjj"u4A?+}> /ã;ףP2)=f4μAu^⨧mmNE5~;ӑ3VJ?f2q+imGIcyU?/@2-BѺEkq'M7hW{`PQ vmG- 1*IՁь9\vyI3nOTvGkY;(;4Yig5 Y}1f;f͸{YIu:"3Z蘞p\ k4ҿt'C $>6N`n=HV:5^=ⳳ`4foEY-RbsŠK/aܡC .LLG ;ok[gjvf2|;rG nuYw7«!FZ[&agɲY3mwc/mژ5 ͘4,;HfJir) ? W!l(毊kvsy`I̠_9ڽ!Zt:ґ +A{vOu:RyVۆ%\3-1'",(40r[#OXF{k3yX8VJEs#& 0NĀi1xr<@=].ZeA~9c{=鋧^망ع`Dc+ћ.hHE%c'\EMm◮ <߄h=c,NVʃrK H V1m&$ h"$a4jGf ;{{T9ρT:Fm5HnՑ7]!Q wf%麼2y9XĚ5QtREh d-5^$ ͹GFϯ-7i],"&4:.|]UؽZHz*ć>P- [Œt [K! >Ev`e̱CP'-QJ4lG8)8Wt[6ү^ ɎE&3>>y4FLYJ<(P_Ҕ[cQim/,[cy[ V* {IBxx/+Qmac6uMҀQ6&+Q `BŃ>\iSnNJe#մ" lZC | uyE|qEe}Ċ~=ygf ѥ9fՏNM͡%^4#Iz=`i CtX*83RtGf.C?cQ o=ǖ=B3՟. Dp=xV $558g VcB^~; QDI5oHXolwQ&|) >uW&B/?t4'7FpEVV8r8DLm@}ӑG xg{ۚ,txc?$\BxSJ:|Lj%@LH oA@AόP uP%DA,UH% Kf/pfx81À2DDYBϢ OSݷ *q I2E4|ĥ)-2eԈ"s{CNf S0AXU*fxRa odn-c{<;]6mڶQ.} ~p2I[+k;~Y^kn5r?RA[ U -HS?G\@g8Fr¯U8^ՠ֬:d#-H5f?pg3a|9΀[ 0i{"l+ܴ :m, d!~}#BG3V1gzB 5W?Ў/Ff9UGv?Go[s=ϋǷWn`9S1ذGHX:ȑ;|Mܵ2" I~=nt |oEKN_SJ.w!縝۪Ơ5'r56[vZS!}Jݚ[ D;J7'vcwc<7W_ Zb1 s+숄6^QvZƝL$0% ܀Gg@|7Gcԯq6 e()AIMP9؆^`.rtBʀYn^:9O@-j;1+!;s'q(d|6{fw3ޫAb)}M6N].DU\$Ad =џa(9amD\Yvȋ\n @pi8~?DK;)>ك6sΗhIYR4ތ"\i W?CiH;㻛CǡH|{d*EڀæEIf:1]jB9և;'Â?cbl_{|.G5-Ǥmw kҳ9xSjfB &Gm\Sj4_T  \W(W `y[#ōj8r!+s-i%*sW*wֵSu zo^1{03rl=5C sGȽo QNP6Z ŗY.  /O{f?q?@UOalu$UJ~6f hrS+<6{=`USUDfܾzsBH߅`oA2 $:( Ϟ?j*l^7L=~ МA㹆Cd?O}E)&I<3"K>iܪ:A㨣ۓmG+U?WavG}.)T `yum7es n> mZ1/gKYɤb+9ݧ"H1"f0sqIw?RaÚ({1-H}3tq@csP Z;}e )4ŰP/~8w 쭽~4״\yǪ[k0'rUh"oDl^A4ń/_ {6j% Tp26d']E%( {ώ"Y$izDsN%>$ =# K +frCl3r(0vG=ŴΥT.jws<4/Oc2e &I]{K A3-.ǡ!̥āuh'*77fh-+{LُŰem/!)Qm'h I !UG3$k 1|јږ*} Kt8UψĠ )BmO1lF̗ 4zh. >Fʥ2$*ALelr /6#]7ΚB;.#([$˄7Gv3^Qktr/;$M33@Ct2DS&0qHd\xhP7,sq-$PX ak΀VWZl?tZ=>B %Qif:j&shy?% ں**>?g (~:ߨ9͌y|AM, ]z~O0(2'iw/#ߏH;Hl шel?y-@cz5ʈe@RuaǖlaeerZ\v{l<qtUﶙanY0fs}ǣX̧˹{YO%ZmiOoEʙ ˸[( _D3p!n0#Zk]mٷWɲaw-)M?,RA roS`z)r!h/4xd9Ng*) &Wt),pr\$l1,$cJ?`J# &tCtH ^3MxTkݭ[돻7}a[Tl;yEG%2)!TJNf5a&J!sT3'O<;W0y΃Yo<`$3SBB}p2rH\KX{l=uL\nXŌ S;GV~+E. $KP?Qipψ*b!aH I1}E. 'j n)G?Ķ'BHU9X|pc"h^WG~\ ,jfwŠ'e2nn>3!ӑS3k'aϹa@.qRbFT/$a~0-CKpiM<ȃ&Qzj;c[$Z??5Քk8Evs|Ѓ Uss1kK62cFh8%׿OMS5 Sl~w:605a'<8"2s _/_[6|(R )WYv-ʝ $|ۯܣhjw, NtSՇmroDXTŸT;RҼ߼h^ZJ̀ZԏvM9"̿V`me&y>XXkRǵJ9KRi7גqث^Cdx } pѰ.8YP=[ NOa$w p MES0`sNR6+vcD$9f t\/-WaZ ,1"@ϤSŠɎQ4*rJnyY*\t7ԒKZW.BJ7ARZԎZٗF_KJ1CݭSܱ{U4D=, c"y~{Rqx|:; caFW]%g1Jd\Z8⡣G7h~6\(‹Z' OQ#J_# /a/3FezgdzN7ullux}tsWVkPlsos-` %0ݻ2֖>>Ų ̌K!eiM:ޞ"Xl/F [ҿ&>Eu4# |gXh@` i?WR|_EuQOM0. %Ǩs1ɇ[Ҥ}kc\4yy8Ήu*U*9}rsAkoGv ig ^giyso&0-Km `nG0VmRLstȫ5t͌ 0e+ 0y"3']T~pKB#n~g+iUדt@Sz,$'8<'^ C/w~hK$z4(w (Sh]H/ N+4 qV`]3RE Nh7}a0M=Nja>մ Vl۝ڢ) Li h-[S1,kG;iR?_#B0jU,ʝkj?fI IC-=#yY▇tFzׁ?[h=~kX7@S>T:v.l[M \l:| Hnp%艵;R[Y[{NU8-S'< jʖ`TBA:gEK BAoNmGVSޔH%d >W/v }z1$ `MPHE=`&YzF,e><8T j# _LQEOȂ*0cUn.:FGzbQjmXP7Li#IG浥p% J^ "C(ô{- eNgJ0#Bifi˦7P,UzEFi^ TQ΋}ע\"0FU<-)6 $y#'7ej1\*iY7_ߖ x7I&qV QK%h#~H8X#ߛNjk6?uV{KgY"Jͬxтf`5Ɵ.捶Iv vHUl:\ڣҰ RW)zχjP93D)J*ư@j6FkRAc~\FOJ*-+k5U0Gm`T4R҄TNceN]E{tSb\ 0Yصv2yEWCc?kKT; TN+J>i!udcĖ{37ͥRQKGsXO 0Ft'/s~r^RSBL4c.;Oib}QIzOMHCgეI%e/;y7%7D)VXＱhv;3Bߋ"1*Z2r[I-,Yn$ӕyok>`ۛ@Ԍ]8zŸrPeHxʎ{ɫYiHl@B rz|BT5Wo[ 1sbZUU^tqp}lsʞW r`mkw)UI},CT]yW? Q8Dfq8¡7_zbILVZ!hzH$=ֺL9e3<{L{HV,2-dgFnIlIPһZm&) ʡ)zTQ;ɪKh4@6{1pN[Im.$YKSk=c 6⎵ᙊ{'ރ#qf) 9NB%T>PC]jP w |d!x 'Z/7NaPTnp* #g m7}<*7O~[;֟.Vy(jDe–C[`lAեBQs ~`n"@#ܾ\. @Sg?+ߛDfdfথ >_'^{s(Pވ??'&֊Sdf6(c )#աe^_"&rEA:4ϩYu-' Z4!O >h5N(@AwVB`@m,{Y:L1䜺і9Zcd*,rא{FH (r)If1r!;&zcgzM̠ Gf\~ Js E6Āѹ~[md(sҠ9 2,SCDY Qlt`Td4gǼ[(EMC=ݏ9 6x%X4|>:%E;_؊2y%ř捧\Xm!M{78+szzdA*6UY7O_`G+QI6v03̕1ߋJ|7r1 РtHƈrhs[֭DXGo| ;%taȗ᥼`׾ځٟ:GW ;z˜w ]x172bHXcP 3I5|Tg6֪;eʣ4 {g ~#燞:`es7 }0;($_og"f7Pwo"̪3uCe~*?B\ַ8C;Cʗ6M;ئlcFOs#,R z3/Ъa0kdÝ1¤n3+ Pfߺty"(KO{[LaJ>f0HRTNѹPN$)܍HCeS!S pW]`() Զ5bLZꆩ*,9FYG*Pz]y_fI- ^uthW޹Y`x`ϛ/w8alH8A#l*jpJ=ax]ed^#gR)y͇ '(i63!N%NsZ-:X#`רك8n NQZ b{/I $,I@4<>=]Mb ր= g3 E'|E68},'z>DM]l:k5ڙbK;L^"g8v2iz S e ُñ'\F{cMqeA{ 9M+Im\H#U-5Ey`U l\CW-d>rs&5$Ea}}4c,T$M=1k4]Aj#ֲ0=:pg"+0l!\Dnk\*Z5.iK}Fs~AR-45x=q'-dHZ : :;=>R:mRoLMb1gFSpϦWBv 'D_H+:&6ߔ-Eُ4@ ?r0Vyt핱;zp{;vB2\<|R cOϡ~K6i4R!YϱV+)(AT a4%`q&|Q}!ס 9@al(z49D66:JN}ŧp=KF)[7v>sJAdNbŽ۫|I8 jLy?Ҝ4(H FDEfo[4ECPee"v.+ TMOI›O<+خV-DŽh- 'X7P''8/u6Z î 8CT2|c5{a[9 f¸-[=(R}Z@<(qͧ!!68+. ÿl5#ѼV:zA;O~hhs#*N62 RWqjgz՚\#x52.#V0G_ϭ0TWk\i^olbrύG3 OXa+RO/jܠԬڂJ$gwp 7kL[`r%{rdv"i}~IL$ܽ= ,HsWP R il_#oo~}+kUD  3;!6Fd|ԭ`[| F-\۴_i$qPPJF4/^꾅ј7yC)Y(^ hӥQeRYB\5@nehRxvݑˍ D(e]::1p (n*LґS #&ݐauЦ6MN=273qzڶ5CvgCz|b( #{2{k-f>\2m&t|ռ#ىDju؈8yr*3w5ז/pl $Ag2">oq \e>;}"s 9 ` 0cvԹ= -,,xV&?fJXdÓYa uѢܡ!Av$#hiE7Et>>hV[޻#we;EwCjVRw_t/J{\~N/0l5΁#/o_$ٌáY5D4HI5Ł R٬9 fXA!]Y;\ J+R0*u_BY3,DQ/x>Ȩc^"hd+E>`ȸ5~\<If8AsLJEjf֍c=ۂQCqpIvMi!2C[tT]n[g`EDĎ@nXwl-šq354K}w|[۽HfnG2+i>"^tF'o&qȝ!z=h0qacLհI+U:\9^}CeFoZݮj)ſQֻvӊY9DZEMUX N~\o Iv ^Vapo5d,aKw}mzM,޶ӜDlF;yC84:>@=br`=MC0A+esZ#`eH`7,`yZ;xMp|׀,!I밼w oY _^V:SlKwg IVx$-IifG*)H.w&*rFKFo=%\/7ռx7aK+ S?'1;6,7COg2o?.2Ί?AU96`UOt"m46Xsf;5skh3ہM~hs_ɂxLfSDpBP n ۰+m - 1A?3 [EHa1z eFc`r*B űٽb_&y)dv;KEpi/0ɠ{g I`638Sosm4^+|Dwb̘Zc G΄&~y3j9 ?/rV) Qg~DW@; _Ȩ3/TIMRBӈa z<rn(F^N=ɄǑXdOf%)3ZyWݢ<\`8 YƋ%sʷfvgqUZ(gWxմSnI^{-LJҫ($w-.#0%!8)QĤ/~MSEADm|:dsP ,CI2C']Xyˮȩ-gYkY?V*H@E\>@Ob*^E>l`;ԉ,}+t_IL$V&E<;{=TsT2B5j rf X*ZR~dEG oPL=h(jUB먖Z{7*/\JAFHZM\. `OD.VFV/t~;#J1V _ 1ZM8H1ŬGqK(no͉c̔#W?XEˉrʊ-@C!5z{)+pf,..t؂ $ҳ>?X[/ [&o-'z<,Eh +kk <&_ɝˊWg;{C:z "DstvkHwKx}cKg6urx0 C66L,uGxt! iڰ71eXJa`$Te*=Wi*q +V$ L{R=B} Z0e_;y[|*c`EkA=#s0a螡V֎RBuK'^Dts!S{KNB$#/3yC_EpKS N%G—x%o{o Y9I59 G_Vq wTYzEa'1x:2H 8&-yRL%0C"`t n|SыqUj$V3: c f9mȁ63 Fִ: aT\jT٬]`8ڰnFГ"y~Fp$fG_a!Ko^#Qh^י6M+GJIoi2R)AAM8'QeJ"MuԋrK|3NVE>=bfGD˅/O'!pYaت#Cut & y"Z{N82'm+w%qc7Z=?Iw)w^{$*hZ}E~qܣF_<L:mfڑ S%k(ӖM?{W- mvM(] xT)w`H$l6D92A+\G>a=ig@F 8{v6OXW}4ѥ]fyE8Zn,q=,4\liU &H&Li'3Ƭ֞f ,0%7)>?l$9n;o-^FsNxq'@<&d:j xSJx:'|e\+Q`睰7Fz=ZaX @-Wh!"kyBxy׽ XՅ։DuPc7! ъڌ4yڦ[#e~ICZƢ9n#S|lqL[ѧm_{up!iE7͓߫ ۺQy5[FrsCGjhE= U3|ZlsߝaN+ٿ+aEÞ,o݄mp%̘õC.H*YdЎk ZǞ_ H]z<$! jL#]q2Z*4!ܠVaK,Hbw; 2yEv I&&/d]mpnB '#qVFGuZB'!Ʋ9R7pa1it2ܗz.g/fᝏȞY%O6ꥧ 䨂}}v*'r]tb`A{5Km }3skd̝Z9Ng#rWfsΠ(bnWOڑ9H,2,Ip v(-:S#3yp"J9CMn.} znXxҒkurJxf^UKtBTοPH y>b3C/ym"w  ,<ݾ w3TՂLmm沣̵7k(mIXQ}sr:V;8rcr) qㅫY6fjkm{CK1(>ϘjEmN./cr@o G]򏉧>$VSێY|oJCT-Y?)7j7#1ХNA])h&G/3EdxFh(Yܤ 3VT I;Q񛷣- H:P !n61uP.f/ i,[$6Ү*kϐj 9؞m+.H2Hgq{`_8aϕ~*:ʶ@OY5ϣ>/UG)ڻ^q{Q+V3DIҰ#8 GS,R EM!?por H)Ժs->`Sre0"Y[Շ$b:'ޚ׵,( Tl>!!Z.|lg%Nўӆi+ކ0 ܌ĩL&Wa­h: ;\yv3pOɔh^h?e!NPW08 $#YqUkva`ɕb|OSDb tS@-4y7]fGƹcTK튃256REKF>?{C/i:Ed _t:rǗv{4je_j;O*cU'bګej dYFZB`a?!ĢصkH«V'CT4tIm#-:sssTTqo>l{A3^gy;4GMPhE nxc" ǎǼjS;v$QGᨂR5hpU02Pѧp,,D9q` ɱd`MA߇T9Vճ^:8Hmf}(_ Mǖz!D%`{/PZ/[ҥ._sL:Pp*kjFE8T᭐7p_%Iݗ,/'17.?J9uZcM~5!{;*nks*Վ9aʧC!ihwq- ]a ss[nH:gVS}ݴ ͽ;V?AH:Β|,Zh7@'=L>4#WWm5:]@5Ycuo̅+ =*@ ʛPSk`T\Vq}D1XG6/,V(JW?{ ջ(l96ɹr~Ơ A {/" 䟦orB*XODa SP54sH^}+zT7O|kzF"Ke9;^ bF~?A G.36p.pGv|C!)t/F6߶tGm7_lESaf&&8ʁy|ӽѳ<@w F"?-{xUgSĠ4+!> E|J+xjS5aJ3 jLʩf;xXmM0%鮯vd !֌lxڦsft&oߋ/]4]P% ⬒pUBO)uĖN H,{hU,U+5u v>07E9Fv!pWm_ [9b+s;2TR{Q@# N [?zc3]AkMUWQ.{V HWM`o3xO[ Y1~},FU/iM( ToV"_7s$8:#YDEW*Mi]A])tzN5\`KZk&6DȎeѻ69T&.j~Mџ`'ajՙ}牨Vy7}|]`l.y ~S4(bxDmUXhBdAkCՀ+U;j]^DH d,ȵ rω oʟ%*$dzPշk }-T2'߂Ɔ1USGqeS JA&F\hL#+Z<~ ue&`L03 5%Mځ5wSĨnԞ^CLC&ńZ]VPp_$|Nx#ߴQX-4=\ ~3 ^)Q-}͂aYS`:`%5~v.^@#ybk4ǾvI@] YHx$lōjJXw2nS#bJ[v Q鐼#$vUWW H`L Â}Å/unXSYpk$3= ,W|U]([{;],C,:ɶ;D"l8mfT]Z@.tf'# FżCQdg:Kc)8€!!h&nH u艦kJ(͂`eG.Y weᴩ<熃mH%-|8ѱ*iEM% e82aM1âwX6om~ 8qUҎ>E^yvD hg:{piy^? Ex׍ui;H,S-u|{Q"\'}>, d*yu0KL&>#aABKU hVHH /]4MӖQ%u0jWo&2oR@$gjQZE R\ "2hRv 7많+p+iiNJd}'UDt"d4苤:E[\%l!Ӕkku+lD2~v); +HCG%3Vƙ:d7y|ӭ1GuG\7wk(Z6(ֺNɦ'̓\3N׵6Xa 3Pˌ)2k)KN%4 DK3 753l絭 m@숆X?u6jt3L+= ֣W3݀q7`>eLy5f#FL4Q丿Ԟ9[Ι;C ? r4:wh 1QAC"A;X /'C#1`bӬa<#wv"?eG/fĦ.)/\Rt$U!Bm[ZĥNe%yp?B}Y-#LSN]0Gfi$gaEP>tSah-yNC[67tsMvM_ j{gd-ZR:!/B',oho[Fm;nM^r~7hwɡ|5Oſj7_Ɯ}[.l-H8?)b7qA*m:,YxS\2Zuj- PA4.S0E@2o7֓vb]vq<2 O,s<ݦVdp7O`RWߧVy9ΐy\{SI .hyl)"4X*7.;g!O.;bbnqkǟW4/ 8IG S}dL20ݼ_GL (<et`SwFAzkd[S6{9xmyQ:Ґ:^np'^BcQ0Zf bS5<5.4/_ulqLb߬/gyޠCKW;۪U*ј4efbOvYbDIɅU9 KJ>SaڏuWy0@shLWn' qGJ_21b?mGTɥA\6y9ou7tŅ՘e[]O*6_̔HHRXMucA`!;w%A삡3cWU$T~Ap< X'H>aO*ܩ_vPyNHרf LG<M9ZQwTok.J%æ7v=CkoxN*Hv"@ԦȀqTQQnl$]>VAr%,d_y ߁R}e1%UK"m[h55ݨ ZZZ>RhMEqaY~NGa$Fz)H@-$TZřOJ9@\!ULl<eE[9M]6041Z_$rvYnsirgHr%UsʘW\`?@˿[o]GMub3Cqo$/9zI:l+('fܴ :7|8=w盧-+.7i~@A։23=H&WѴ6\?l/M)f@o;FߑTPe- R`߂k FUw܋b)_'"w jK? `Y/V;UV|0.cھE2nL—FFf#9ӥXթ~ch1@ $*l#7+Gw<&™PcA#p VG5v?&rxߕk 2U%lC^aJ(cWC)S 4bHRigsJ1+A6ka {RxIO)>~$P:eILC a0U.iMؐ=NQ-f!o'ֱL=kH `:MXloX ͩK)yx} +h>X* *ۥKVBj}F? Ebù?9`Y6pVO;o?U3=_%:^Q'|g^37"0&U7/jGW K 6 p %cH| *ؗIЧ E6Dc2^gzو2Q2}B~8jd(jnFO/ۜ@s1Ȓ.06U86oPd^Ea1j%MԂ:MZx=L]*[.}(91X tB@x1Wv_C_+@MLIK{(pd=*IhSgSz\`OϋJ>L\D98 9^4Xs"y$[ 7rUf8ND0sh@w>[aCqQb!&H)izj,QQs ̰(Hp~+K*:LM  M;g<vx3!C>mB^MY2(IKb ,uO,R{-eZ/8kpKKN# UsF! ԵM13 ԝӾW2S h] if3K5!û8~O(הߣ10mKȼh&=OV:? +X j*h57ԯ'E|~L4q_xaR~AqANkd-^FB&*Lt&2>hfcjg]Zkh5_PK@6z#sA, A% YZ