openssl-1_1-1.1.1l-150400.7.63.1 < > , 6ĉ eϦp9|b] Yq BɞBbžwWh1HdBך}&y ' c띧Q<3˫= #Ẽ2USKdدr3_SojQ]y1_mma8_g~&ҔʡL t3m|se pv x¥lY L'^ZzMKFVZo!C
8Pd
_i uQEӊ ) > D ;P ? ;@ d # O \ ` l p w w w
w w [ w
x w T w w !$ w # #H # % &T &X &\ ( &] 8 &d 9 ) : 5b B ! F ! G ! w H # w I % w X & Y & Z &X [ &` \ &d w ] (@ w ^ 0 b 0 c 1g d 1 e 1 f 1 l 1 u 2 w v 3
w 6 w x 8 w y : z : : : : ;< C openssl-1_1 1.1.1l 150400.7.63.1 Secure Sockets and Transport Layer Security OpenSSL is a software library to be used in applications that need to
secure communications over computer networks against eavesdropping or
need to ascertain the identity of the party at the other end.
OpenSSL contains an implementation of the SSL and TLS protocols. eϦh02-armsrv3 ۙSUSE Linux Enterprise 15 SUSE LLC OpenSSL https://www.suse.com/ Productivity/Networking/Security https://www.openssl.org/ linux aarch64 ,P |` / V +
%c '$ e p
[
[ 8
Z j
1
h 8 ' . * \ c K 0
K ! p 'C - A큤AA큤AA큤AA eάeΕeΕeάeάeΕeΕeΕeγeγeϜenena$geΕeΕeδeΕeΕeΕeΕeΕeΕeΖeΖeΖeΖeΖeΖeΖeΖeΖeΖeΖeΖeΖeΖeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeδeΖeΖeΖeΖeΖeΖeΖeΖeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeΗeάeΕeΕeΕeΕ f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b f1c1803d13d1d0b755b13b23c28bd4e20e07baf9f2b744c9337ba5866aa0ec3b b653f0b4f9517fcde7b6674837c0dc6fb45a0afa41f9d012c8af7c233b132d73 b46c1f4ca762af97b2442ac0223ec3c5b00c41e1c0e73c746bf50f8d93ecf2a6 f106cf70e66f8f10ae474809dcd341ad12c1eb4bc0a41bf2f4b35ca713d5ba4c e6be83a893718844c3ea67dfe3f55a65d80b30b43348d69bd8ff6ec867ed5225 dc18b5cce6ac566c68680921332613b0b877add5246801d5fc0d664835ca4715 6de7780618d15b87af6a5c891285269049d9c11ea358963974f47d998e74614c 8c16abcefd83fe640e4232e8edfd3ec72cbfcc97cc1ebc01e8d5f5542bac5e38 9c201969f87c50674e9c5708c35cf78101a7e3c9f3e6b9ccfa73abec0a34bb77 2b5c7ad78b1da1d7f539cc85743b28b9597ebec0427412ade36ae2bf70d7bd57 540e494e310ded323fc3e6cee85276890f2f2d5141ce7397b0b2030d654378c6 50551243cf8f6f704673d24cc539bb4f7f11c0c3289d69dae4c656dc0216d769 16f84acd35b46cfdba5f426f13d2463b7383da7d235535e4cb60d17a33af522c 98498c356d94a059fc3dbae192b85ea2e2d10b5e1f42be50907b3b8512ef9d61 e74029befc134f2a47c1cda6fe2a658c2fbd286a85f37266e92b9060786e9e0f 525f577783c9668040258c4d757a736f51a89537e203d22a06b4c1bdd705306f fba826dcb86e84618d88d162cdfd3ee340ccdeac27c2ac764e4a7a2c77015598 3026e8d3c350c158dbfbc80a04a67cc7b2593436a73075e3f752c12361effb1d 4c59e05f848c276306f7bcb09e6d99566211336757a0699d4dba859867557a02 f9c1512d44565ae5c55cf1d74dbfb8212d73c53a759452d3c46fe9d6d8521820 da7c7c194978261e101213a31ea4ed5a251bbd92cbfca64ec21d431b819e8689 e95387675f069536bbe93feeafcc434f44efe811152ac51023a39e4b27dbb6ae fb43e53ead951d43fe7138d8758550dddbb07d31ed2726f9d1d293dc64933e60 aa941c4ae1a8b700d24febbd75f704e01840a9e5856c414e3815bff50820cd4d 4685f8ea20e822b8f9549363fa8f9449761b59fbecc4f7c1e3f99059839c7657 5adcf7622aec9ae707c5f511738167c207c9577c2643048964f3d699cefa8802 ef5aecb772b186a78b0ea3e15536ee84428c6183808bac2c4f6ac09be03e2f59 3b5f9b281bcfe26e1756fa322e603e1e26e11bdec65b6ec8fb2fe16f0fbe1641 d4fcb389a80ab232fe6aaab0a7b0aa06ed91e6ac2faa7e470f793e85d760a205 4508ed103b5412572a13e0363b0cdd2977db8f448e2ba8650a384d41115f38bf edff9f9aa6085cc2950475eb2d83f57ee68a5d78950767f16040758f176ccaa7 04a3f2a812d337657100ca7304c4e17047fa95009162977a555f89da2671b9df 5a6f2a6b2d4130cf1a02ba092220a84d56901859efc736a5feb04bbfd2c835b2 9da5db9aeff181b50592e083a84a0fec2123338a4b6cf55733586d608583a02f 2f5d17c19e588f49636b85ecebf910f151da82c9f9b77a8d7506ebebeb235813 106e1bba2275e877284a51f58e511d64ef9b1cca59b574fd8427213f57d2fedb 351745e6175a4d77f34c628e5e8932d36bf573f93a431a7adcff6245f4b20f8a 008a73b31a06c8d9252788d92adfcdcda3cb480d4fa1db7bfe3a0191492199e5 4f245b552f9035eb0e08fa3aad028398430eafe558c669d80a5222b28978fb29 872eadae604843aeaceb3485fc5d1ed387ffec8e236ae65d447bc252faf62848 5993108278b5f3493c74e55d193fa8b3908575695bb99229f33d39e4717e0bef e9f78f863a0ac47cfaffd3c356a08b3ba11122d5406074e094991432a7c7319d 10adc65e1b355ac2bd1fc050e9983f60a97516f421da99d99b30cbebf3ef23a8 4c8edf24aec408256f2d6d4185c077833bba84883223a515dee6881d34efa520 5059afe8ca66112f2d76267f211aac9011f7fc76b51258677c5d1ef708317ea4 45119dc91546d7f419d979c94472a26660eb5dcf094e98ba0e6ba78484c88479 b829b8b0c2bebe14d8542bb94b89c85c0766222d608f1b24420ac54898957d83 5c0bc9ddf14fbf299733b67a2b2b9412caaec952861e43521a3e847438bf25c8 62c6074cb60f3db9f8907010607efeea620596d9f07b2df31bc1d76c3e3c0a02 3e71de8b3d35f703bfb9a20ce8293a35be7eb1ec8ad8bb661dad24c37aff69ac 500c3df1d3aadbafa26281144061da06cbcbe80544e19c75ff414825a5c85a85 466ec2b684cf3358dbc5e86f51dab48908952936b8c337d554eab68c2d9459e4 d5b4b937bbaec47ca462ac47401b6c440c315abcebff3179f33dc0a46736d41a fa59b66fffe4d3ae4f0f7f6f11e63c44e2e7d2c7c6d9b3cd70b7b2d0fc6f6ede 045626eee6a02e1c81ec5dcee9c2e8a32b4ee46eeefccb730f0e0369b33426fd fbc730825fd705b42468d15b95b5841072a92fc393a68ce2cda6c626a8f7c8f9 8d6643334e5b266b4dbb3ad688363aaea6e50ef26cef082e504a9bee4e89ec40 3386d8ce4ea93fca52c67f8b757faa395aacc551f1dccfbdd4ab3a5c77ecab90 61ab95f7e96f2b0f2acdcafb8afde2f6c43e899416397230c2fae9c1e701e45b 23e35449d18e085d82ed576d754c2dee7cf0580b7f73ed70fbb944278e4c3fa6 rehash.1ssl.gz asn1parse.1ssl.gz rehash.1ssl.gz ca.1ssl.gz ciphers.1ssl.gz cms.1ssl.gz crl.1ssl.gz crl2pkcs7.1ssl.gz dgst.1ssl.gz dhparam.1ssl.gz dsa.1ssl.gz dsaparam.1ssl.gz ec.1ssl.gz ecparam.1ssl.gz enc.1ssl.gz engine.1ssl.gz errstr.1ssl.gz gendsa.1ssl.gz genpkey.1ssl.gz genrsa.1ssl.gz list.1ssl.gz nseq.1ssl.gz ocsp.1ssl.gz passwd.1ssl.gz pkcs12.1ssl.gz pkcs7.1ssl.gz pkcs8.1ssl.gz pkey.1ssl.gz pkeyparam.1ssl.gz pkeyutl.1ssl.gz prime.1ssl.gz rand.1ssl.gz rehash.1ssl.gz req.1ssl.gz rsa.1ssl.gz rsautl.1ssl.gz s_client.1ssl.gz s_server.1ssl.gz s_time.1ssl.gz sess_id.1ssl.gz smime.1ssl.gz speed.1ssl.gz spkac.1ssl.gz srp.1ssl.gz storeutl.1ssl.gz ts.1ssl.gz tsget.1ssl.gz verify.1ssl.gz version.1ssl.gz x509.1ssl.gz tsget.pl root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root root openssl-1_1-1.1.1l-150400.7.63.1.src.rpm config(openssl-1_1) openssl(cli) openssl-1_1 openssl-1_1(aarch-64) ssl @ @ @ @ @ @ @ @ @ @ @ @ @ @
/usr/bin/env config(openssl-1_1) crypto-policies ld-linux-aarch64.so.1()(64bit) ld-linux-aarch64.so.1(GLIBC_2.17)(64bit) libc.so.6()(64bit) libc.so.6(GLIBC_2.17)(64bit) libcrypto.so.1.1()(64bit) libcrypto.so.1.1(OPENSSL_1_1_0)(64bit) libcrypto.so.1.1(OPENSSL_1_1_1)(64bit) libcrypto.so.1.1(OPENSSL_1_1_1l)(64bit) libjitterentropy3 libopenssl1_1 libpthread.so.0()(64bit) libpthread.so.0(GLIBC_2.17)(64bit) libssl.so.1.1()(64bit) libssl.so.1.1(OPENSSL_1_1_0)(64bit) libssl.so.1.1(OPENSSL_1_1_1)(64bit) rpmlib(CompressedFileNames) rpmlib(FileDigests) rpmlib(PayloadFilesHavePrefix) rpmlib(PayloadIsXz) 1.1.1l-150400.7.63.1 3.4.0 1.1.1l-150400.7.63.1 3.0.4-1 4.6.0-1 4.0-1 5.2-1 ssl 4.14.3 eeRe Sddgd!dddw6dkY@d*d d'@ccccccƍc{h@ctctc[@c=qc$e@c*c@c@cc
b?b?bblb@bbobaG@b4t@b0b0b)@b!@b
b
bOa@aaar@ar@aa@a*@a)@apa=a+va @`m`Y@`?z@`>(_j_~@_Wr@_G@^^t@^_@^V]^O@^E:@^C^0"@^)^(9@^&^&]]]]n]x]v>]g@\@\\ac\G\G\A\@[0[
@[u[u[r@[b@[Xf@[Xf@[2*Z4@Z4@ZZ2@ZH@ZZv@Ze@ZTZ OZ OYYKY@YV@Y@Ym@Ym@YOY,
@Y Y Y i@Y @Y @Y @Y @YtY Y X@XXXXXh@Xh@Xh@Xh@Xh@Xh@XXXXX @X6@WSWSW_@W@WW(WWVVՄ@VVa@Ub@U'U@U>UzUyx@Ua@U
@T TTk4Ti@T\@TFJotto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com pmonreal@suse.com otto.hollmann@suse.com pmonreal@suse.com otto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com otto.hollmann@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com otto.hollmann@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com otto.hollmann@suse.com pmonreal@suse.com otto.hollmann@suse.com pmonreal@suse.com pmonreal@suse.com otto.hollmann@suse.com otto.hollmann@suse.com pmonreal@suse.com pmonreal@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com jsikes@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com pmonreal@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com jsikes@suse.com pmonreal@suse.com pmonreal@suse.com vcizek@suse.com pmonreal@suse.com vcizek@suse.com pmonreal@suse.com pmonrealgonzalez@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com jsikes@suse.com pmonrealgonzalez@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com pmonrealgonzalez@suse.com vcizek@suse.com pmonrealgonzalez@suse.com jsikes@suse.com vcizek@suse.com jsikes@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com sflees@suse.de vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com dimstar@opensuse.org vcizek@suse.com tchvatal@suse.com schwab@suse.de vcizek@suse.com dimstar@opensuse.org dimstar@opensuse.org vcizek@suse.com vcizek@suse.com meissner@suse.com jengelh@inai.de tchvatal@suse.com vcizek@suse.com jimmy@boombatower.com tchvatal@suse.com vcizek@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com vcizek@suse.com vcizek@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com vcizek@suse.com tchvatal@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com tchvatal@suse.com vcizek@suse.com meissner@suse.com vcizek@suse.com vcizek@suse.com michael@stroeder.com vcizek@suse.com vcizek@suse.com vcizek@suse.com dvaleev@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com dvaleev@suse.com normand@linux.vnet.ibm.com crrodriguez@opensuse.org vcizek@suse.com vcizek@suse.com vcizek@suse.com vcizek@suse.com meissner@suse.com meissner@suse.com brian@aljex.com meissner@suse.com brian@aljex.com crrodriguez@opensuse.org - Security fix: [bsc#1219243, CVE-2024-0727]
* Add NULL checks where ContentInfo data can be NULL
* Add openssl-CVE-2024-0727.patch - Security fix: [bsc#1216922, CVE-2023-5678]
* Fix excessive time spent in DH check / generation with large Q
parameter value.
* Applications that use the functions DH_generate_key() to generate
an X9.42 DH key may experience long delays. Likewise,
applications that use DH_check_pub_key(), DH_check_pub_key_ex
() or EVP_PKEY_public_check() to check an X9.42 DH key or X9.42
DH parameters may experience long delays. Where the key or
parameters that are being checked have been obtained from an
untrusted source this may lead to a Denial of Service.
* Add openssl-CVE-2023-5678.patch - Displays "fips" in the version string (bsc#1215215)
* Add openssl-1_1-fips-bsc1215215_fips_in_version_string.patch - Security fix: (bsc#1213853, CVE-2023-3817)
* Fix excessive time spent checking DH q parameter value
(bsc#1213853, CVE-2023-3817). The function DH_check() performs
various checks on DH parameters. After fixing CVE-2023-3446 it
was discovered that a large q parameter value can also trigger
an overly long computation during some of these checks. A
correct q value, if present, cannot be larger than the modulus
p parameter, thus it is unnecessary to perform these checks if
q is larger than p. If DH_check() is called with such q parameter
value, DH_CHECK_INVALID_Q_VALUE return flag is set and the
computationally intensive checks are skipped.
* Add openssl-1_1-CVE-2023-3817.patch - Dont pass zero length input to EVP_Cipher because assembler
optimized AES cannot handle zero size. [bsc#1213517]
* Add openssl-dont-pass-zero-length-input-to-EVP_Cipher.patch - Security fix: [bsc#1213487, CVE-2023-3446]
* Fix DH_check() excessive time with over sized modulus.
* The function DH_check() performs various checks on DH parameters.
One of those checks confirms that the modulus ("p" parameter) is
not too large. Trying to use a very large modulus is slow and
OpenSSL will not normally use a modulus which is over 10,000 bits
in length.
However the DH_check() function checks numerous aspects of the
key or parameters that have been supplied. Some of those checks
use the supplied modulus value even if it has already been found
to be too large.
A new limit has been added to DH_check of 32,768 bits. Supplying
a key/parameters with a modulus over this size will simply cause
DH_check() to fail.
* Add openssl-CVE-2023-3446.patch openssl-CVE-2023-3446-test.patch - Check OCSP RESPONSE in s_client and terminate connection if a
revoked certificate is found. Add OCSP_RESPONSE_check_status()
function to do that check. [bsc#1212623]
* Add openssl-s_client-check-ocsp-status.patch - Security Fix: [bsc#1207534, CVE-2022-4304]
* Reworked the Fix for the Timing Oracle in RSA Decryption
The previous fix for this timing side channel turned out to cause
a severe 2-3x performance regression in the typical use case
compared to 1.1.1s.
* Add openssl-CVE-2022-4304.patch
* Removed patches:
- openssl-CVE-2022-4304-1of2.patch
- openssl-CVE-2022-4304-2of2.patch
* Refreshed patches:
- openssl-CVE-2023-0464.patch
- openssl-CVE-2023-0465.patch - Update further expiring certificates that affect tests [bsc#1201627]
* Add openssl-Update-further-expiring-certificates.patch - Security Fix: [CVE-2023-2650, bsc#1211430]
* Possible DoS translating ASN.1 object identifiers
* Add openssl-CVE-2023-2650.patch - Security Fix: [CVE-2023-0465, bsc#1209878]
* Invalid certificate policies in leaf certificates are silently ignored
* Add openssl-CVE-2023-0465.patch
- Security Fix: [CVE-2023-0466, bsc#1209873]
* Certificate policy check not enabled
* Add openssl-CVE-2023-0466.patch - Security Fix: [CVE-2023-0464, bsc#1209624]
* Excessive Resource Usage Verifying X.509 Policy Constraints
* Add openssl-CVE-2023-0464.patch FIPS: Service-level indicator [bsc#1208998]
* Add additional check required by FIPS 140-3. Minimum values for
PBKDF2 are: 112 bits for key, 128 bits for salt, 1000 for
iteration count and 20 characters for password.
* Add openssl-1_1-ossl-sli-008-pbkdf2-salt_pass_iteration.patch - FIPS: Serialize jitterentropy calls [bsc#1207994]
* Add openssl-1_1-serialize-jitterentropy-calls.patch - Security Fix: [bsc#1207533, CVE-2023-0286]
* Fix X.400 address type confusion in X.509 GENERAL_NAME_cmp
for x400Address
* Add openssl-CVE-2023-0286.patch - Security Fix: [bsc#1207536, CVE-2023-0215]
* Use-after-free following BIO_new_NDEF()
* Add patches:
- openssl-CVE-2023-0215-1of4.patch
- openssl-CVE-2023-0215-2of4.patch
- openssl-CVE-2023-0215-3of4.patch
- openssl-CVE-2023-0215-4of4.patch - Security Fix: [bsc#1207538, CVE-2022-4450]
* Double free after calling PEM_read_bio_ex()
* Add patches:
- openssl-CVE-2022-4450-1of2.patch
- openssl-CVE-2022-4450-2of2.patch - Security Fix: [bsc#1207534, CVE-2022-4304]
* Timing Oracle in RSA Decryption
* Add patches:
- openssl-CVE-2022-4304-1of2.patch
- openssl-CVE-2022-4304-2of2.patch - FIPS: Add Pair-wise Consistency Test when generating DH key [bsc#1207182]
* Add openssl-fips-DH-Pair-wise-Consistency.patch - FIPS: Service-level indicator [bsc#1190651]
* Mark PBKDF2 with key shorter than 112 bits as non-approved
* Add openssl-1_1-ossl-sli-007-pbkdf2-keylen.patch - FIPS: Service-level indicator [bsc#1190651]
* Consider RSA siggen/sigver with PKCS1 padding also approved
* Add openssl-1_1-ossl-sli-006-rsa_pkcs1_padding.patch - FIPS: Service-level indicator [bsc#1190651]
* Return the correct indicator for a given EC group order bits
* Add openssl-1_1-ossl-sli-005-EC_group_order_bits.patch - FIPS: Add a missing dependency on jitterentropy-devel for
libopenssl-1_1-devel [bsc#1202148] - FIPS: OpenSSL service-level indicator - Allow AES XTS 256 [bsc#1190651]
* Add patches: openssl-1_1-ossl-sli-004-allow-aes-xts-256.patch - FIPS: Default to RFC-7919 groups for genparam and dhparam
* Add openssl-1_1-FIPS-default-RFC7919.patch [bsc#1180995] - FIPS: list only FIPS approved digest and public key algorithms
[bsc#1121365, bsc#1190888, bsc#1193859, bsc#1198471, bsc#1198472]
* Add openssl-1_1-fips-list-only-approved-digest-and-pubkey-algorithms.patch
* Disabled test 15-test_ec.t in FIPS mode - FIPS: Add KAT for the RAND_DRBG implementation [bsc#1203069]
* Add openssl-1_1-fips-drbg-selftest.patch - FIPS: openssl: RAND api should call into FIPS DRBG [bsc#1201293]
* The FIPS_drbg implementation is not FIPS validated anymore. To
provide backwards compatibility for applications that need FIPS
compliant RNG number generation and use FIPS_drbg_generate,
this function was re-wired to call the FIPS validated DRBG
instance instead through the RAND_bytes() call.
* Add openssl-1_1-FIPS_drbg-rewire.patch - Fix memory leaks introduced by openssl-1.1.1-fips.patch [bsc#1203046]
* Add patch openssl-1.1.1-fips-fix-memory-leaks.patch - FIPS: OpenSSL: Port openssl to use jitterentropy
[bsc#1202148, jsc#SLE-24941]
* Add openssl-1_1-jitterentropy-3.4.0.patch
* Add build dependency on jitterentropy-devel >= 3.4.0 and
libjitterentropy3 >= 3.4.0 - FIPS: OpenSSL Provide a service-level indicator [bsc#1190651]
* Add patches:
- openssl-1_1-ossl-sli-000-fix-build-error.patch
- openssl-1_1-ossl-sli-001-fix-faults-preventing-make-update.patch
- openssl-1_1-ossl-sli-002-ran-make-update.patch
- openssl-1_1-ossl-sli-003-add-sli.patch - FIPS: Add zeroization of temporary variables to the hmac integrity
function FIPSCHECK_verify(). [bsc#1190653]
* Add openssl-1_1-Zeroization.patch - Encrypt the sixteen bytes that were unencrypted in some circumstances
on 32-bit x86 platforms.
* [bsc#1201099, CVE-2022-2097]
* added openssl-CVE-2022-2097.patch - Added openssl-1_1-Fix-file-operations-in-c_rehash.patch
* bsc#1200550
* CVE-2022-2068
* Fixed more shell code injection issues in c_rehash - Added openssl-update_expired_certificates.patch
* Openssl failed tests because of expired certificates.
* bsc#1185637
* Sourced from https://github.com/openssl/openssl/pull/18446/commits - Security fix: [bsc#1199166, CVE-2022-1292]
* Added: openssl-CVE-2022-1292.patch
* properly sanitise shell metacharacters in c_rehash script. - FIPS: Added signature verification test to
bsc1185319-FIPS-KAT-for-ECDSA.patch - FIPS: add bsc1185319-FIPS-KAT-for-ECDSA.patch
* Known answer test for ECDSA
* bsc#1185319
- FIPS: add bsc1198207-FIPS-add-hash_hmac-drbg-kat.patch
* Enable tests for Deterministic Random Bit Generator
* bsc#1198207
- Bypass a regression test that fails in FIPS mode.
* [openssl-1_1-shortcut-test_afalg_aes_cbc.patch] - FIPS: Additional PBKDF2 requirements for KAT [bsc#1197280]
* The IG 10.3.A and SP800-132 require some minimum parameters for
the salt length, password length and iteration count. These
parameters should be also used in the KAT.
* Add openssl-1_1-FIPS-PBKDF2-KAT-requirements.patch - Security Fix: [bsc#1196877, CVE-2022-0778]
* Infinite loop in BN_mod_sqrt() reachable when parsing certificates
* Add openssl-CVE-2022-0778.patch openssl-CVE-2022-0778-tests.patch - Added openssl-1_1-use-include-directive.patch so that the default
/etc/ssl/openssl.cnf file will include any configuration files that
other packages might place into /etc/ssl/engines.d/ and
/etc/ssl/engdef.d/ This is a fix for bsc#1004463 where scripting was
being used to modify the openssl.cnf file. The scripting would fail
if either the default openssl.cnf file, or the sample openssl-ibmca
configuration file would be changed by upstream.
- Updated spec file to create the two new necessary directores for
the above patch. [bsc#1194187, bsc#1004463] - FIPS: add openssl-1_1-fips-bsc1190652_release_num_in_version_string.patch
* bsc#1190652 - Provide a service to output module name/identifier
and version - Security fix: [bsc#1192820, CVE-2002-20001]
* Fix DHEATER: The Diffie-Hellman Key Agreement Protocol allows
remote attackers (from the client side) to send arbitrary
numbers that are actually not public keys, and trigger
expensive server-side DHE calculation.
* Stop recommending the DHE in SSL_DEFAULT_SUSE_CIPHER_LIST
* Rebase openssl-DEFAULT_SUSE_cipher.patch - FIPS: Reintroduce the FFC and ECC checks in openssl-DH.patch
that were removed in the update to 1.1.1l [bsc#1185313] - FIPS: Fix sn_objs and ln_objs in crypto/objects/obj_mac.num
* Rebase openssl-DH.patch [bsc#1194327]
- Merge openssl-keep_EVP_KDF_functions_version.patch into
openssl-1.1.1-evp-kdf.patch
- Add function codes for pbkdf2, hkdf, tls and ssh selftests.
Rebase patches:
* openssl-fips-kdf-hkdf-selftest.patch
* openssl-kdf-selftest.patch
* openssl-kdf-ssh-selftest.patch
* openssl-kdf-tls-selftest.patch - Pull libopenssl-1_1 when updating openssl-1_1 with the same
version. [bsc#1195792] - FIPS: Fix function and reason error codes [bsc#1182959]
* Add openssl-1_1-FIPS-fix-error-reason-codes.patch - Enable zlib compression support [bsc#1195149] - Remove the openssl-has-RSA_get0_pss_params provides as it is
now fixed in the nodejs16 side [bsc#1192489] - FIPS: Move the HMAC-SHA2-256 used for integrity test [bsc#1185320]
* Add openssl-FIPS-KAT-before-integrity-tests.patch - FIPS: Add missing KAT for HKDF/TLS 1.3/IPSEC IKEv2 [bsc#1192442]
* Add openssl-fips-kdf-hkdf-selftest.patch - Add a provides for openssl-has-RSA_get0_pss_params as required by
nodejs16. [bsc#1192489] - Backport cryptographic improvements from OpenSSL 3 [jsc#SLE-19742]
* Optimize RSA on armv8: openssl-1_1-Optimize-RSA-armv8.patch
* Optimize AES-XTS mode for aarch64:
openssl-1_1-Optimize-AES-XTS-aarch64.patch
* Optimize AES-GCM for uarchs with unroll and new instructions:
openssl-1_1-Optimize-AES-GCM-uarchs.patch - Add support for livepatches (jsc#SLE-20049).
- Generate ipa-clones tarball artifact when livepatching is enabled. - POWER10 performance enhancements for cryptography [jsc#SLE-18136]
* openssl-1_1-Optimize-ppc64.patch - Import centralized crypto policy profile from Factory [jsc#SLE-15832]
* openssl-1.1.1-system-cipherlist.patch
* openssl-1_1-disable-test_srp-sslapi.patch
* openssl-1_1-seclevel.patch
* openssl-1_1-use-seclevel2-in-tests.patch - Update to openssl-1.1.1l ('L' as in 'Lima') for SUSE-SLE-15-SP4
* jsc#SLE-19640, jsc#PM-2816
- Changes in 1.1.1l:
* [bsc#1189520, CVE-2021-3711] Fixed an SM2 Decryption Buffer Overflow.
* [bsc#1189521, CVE-2021-3712] Fixed various read buffer overruns
processing ASN.1 strings
- Changes in 1.1.1k
* Fixed a problem with verifying a certificate chain when using
the X509_V_FLAG_X509_STRICT flag. This flag enables additional
security checks of the certificates present in a certificate
chain. It is not set by default. ([CVE-2021-3450])
[bsc#1183851]
* Fixed an issue where an OpenSSL TLS server may crash if sent a
maliciously crafted renegotiation ClientHello message from a
client. If a TLSv1.2 renegotiation ClientHello omits the
signature_algorithms extension (where it was present in the
initial ClientHello), but includes a signature_algorithms_cert
extension then a NULL pointer dereference will result, leading
to a crash and a denial of service attack.
A server is only vulnerable if it has TLSv1.2 and renegotiation
enabled (which is the default configuration). OpenSSL TLS
clients are not impacted by this issue. ([CVE-2021-3449])
[bsc#1183852]
- Changes in 1.1.1j
* Fixed the X509_issuer_and_serial_hash() function. It attempts
to create a unique hash value based on the issuer and serial
number data contained within an X509 certificate. However it
was failing to correctly handle any errors that may occur
while parsing the issuer field [bsc#1182331, CVE-2021-23841]
* Fixed the RSA_padding_check_SSLv23() function and the
RSA_SSLV23_PADDING padding mode to correctly check for
rollback attacks.
* Fixed the EVP_CipherUpdate, EVP_EncryptUpdate and
EVP_DecryptUpdate functions. Previously they could overflow the
output length argument in some cases where the input length is
close to the maximum permissable length for an integer on the
platform. In such cases the return value from the function call
would be 1 (indicating success), but the output length value
would be negative. This could cause applications to behave
incorrectly or crash. [bsc#1182333, CVE-2021-23840]
* Fixed SRP_Calc_client_key so that it runs in constant time.
The previous implementation called BN_mod_exp without setting
BN_FLG_CONSTTIME. This could be exploited in a side channel
attack to recover the password. Since the attack is local host
only this is outside of the current OpenSSL threat model and
therefore no CVE is assigned.
- Changes in 1.1.1i
* Fixed NULL pointer deref in GENERAL_NAME_cmp
* bsc#1179491, CVE-2020-1971
- Changes in 1.1.1h
* Disallow explicit curve parameters in verifications chains when X509_V_FLAG_X509_STRICT is used
* Enable 'MinProtocol' and 'MaxProtocol' to configure both TLS and DTLS contexts
- Changes in 1.1.1g
* Fixed segmentation fault in SSL_check_chain (CVE-2020-1967, bsc#1169407)
Server or client applications that call the SSL_check_chain() function
during or after a TLS 1.3 handshake may crash due to a NULL pointer
dereference as a result of incorrect handling of the
"signature_algorithms_cert" TLS extension. The crash occurs if an invalid
or unrecognised signature algorithm is received from the peer. This could
be exploited by a malicious peer in a Denial of Service attack.
* Added AES consttime code for no-asm configurations
an optional constant time support for AES was added
when building openssl for no-asm.
- Changes in 1.1.1f
* Revert the unexpected EOF reporting via SSL_ERROR_SSL
- Changes in 1.1.1e
* Properly detect EOF while reading in libssl. Previously if we hit an EOF
while reading in libssl then we would report an error back to the
application (SSL_ERROR_SYSCALL) but errno would be 0. We now add
an error to the stack (which means we instead return SSL_ERROR_SSL) and
therefore give a hint as to what went wrong.
* Check that ed25519 and ed448 are allowed by the security level. Previously
signature algorithms not using an MD were not being checked that they were
allowed by the security level.
* Fixed SSL_get_servername() behaviour. The behaviour of SSL_get_servername()
was not quite right. The behaviour was not consistent between resumption
and normal handshakes, and also not quite consistent with historical
behaviour. The behaviour in various scenarios has been clarified and
it has been updated to make it match historical behaviour as closely as
possible.
* Corrected the documentation of the return values from the EVP_DigestSign*
set of functions. The documentation mentioned negative values for some
errors, but this was never the case, so the mention of negative values
was removed.
* Added a new method to gather entropy on VMS, based on SYS$GET_ENTROPY.
The presence of this system service is determined at run-time.
* Added newline escaping functionality to a filename when using openssl dgst.
This output format is to replicate the output format found in the '*sum'
checksum programs. This aims to preserve backward compatibility.
* Print all values for a PKCS#12 attribute with 'openssl pkcs12', not just
the first value.
- Dropped the following patches:
* openssl-1_1-CVE-2019-1551.patch
* openssl-fips-dont_run_FIPS_module_installed.patch
* openssl-fips_fix_selftests_return_value.patch
* openssl-CVE-2020-1967.patch
* openssl-CVE-2020-1967-test1.patch
* openssl-CVE-2020-1967-test2.patch
* openssl-CVE-2020-1967-test3.patch
* openssl-CVE-2020-1971.patch
* openssl-CVE-2021-23840.patch
* openssl-CVE-2021-23841.patch
* openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch
* openssl-1.1.1-fips_list_ciphers.patch
* CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
* CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
* CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
* CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch
* CVE-2021-3712-other-ASN1_STRING-issues.patch
- Rebased the following patches:
* 0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch
* 0003-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch
* openssl-1.1.0-issuer-hash.patch
* openssl-1.1.0-no-html.patch
* openssl-1.1.1-evp-kdf.patch
* openssl-1.1.1-fips-crng-test.patch
* openssl-1.1.1-fips-post-rand.patch
* openssl-1.1.1-fips.patch
* openssl-1.1.1-ssh-kdf.patch
* openssl-DH.patch
* openssl-Enable-curve-spefific-ECDSA-implementations-via-EC_M.patch
* openssl-assembly-pack-accelerate-scalar-multiplication.patch
* openssl-fips_selftest_upstream_drbg.patch
* openssl-kdf-selftest.patch
* openssl-kdf-ssh-selftest.patch
* openssl-kdf-tls-selftest.patch
* openssl-s390x-assembly-pack-accelerate-ECDSA.patch
* openssl-s390x-assembly-pack-accelerate-X25519-X448-Ed25519-and-Ed448.patch
* openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
* openssl-s390x-fix-x448-and-x448-test-vector-ctime-for-x25519-and-x448.patch - Other OpenSSL functions that print ASN.1 data have been found to assume that
the ASN1_STRING byte array will be NUL terminated, even though this is not
guaranteed for strings that have been directly constructed. Where an application
requests an ASN.1 structure to be printed, and where that ASN.1 structure
contains ASN1_STRINGs that have been directly constructed by the application
without NUL terminating the "data" field, then a read buffer overrun can occur.
* CVE-2021-3712 continued
* bsc#1189521
* Add CVE-2021-3712-other-ASN1_STRING-issues.patch
* Sourced from openssl-CVE-2021-3712.tar.bz2 posted on bsc-1189521
2021-08-24 00:47 PDT by Marcus Meissner - A bug in the implementation of the SM2 decryption code means that the
calculation of the buffer size required to hold the plaintext returned by the
first call to EVP_PKEY_decrypt() can be smaller than the actual size required by
the second call. This can lead to a buffer overflow when EVP_PKEY_decrypt() is
called by the application a second time with a buffer that is too small.
* CVE-2021-3711
* bsc#1189520
* Add:
CVE-2021-3711-1-Correctly-calculate-the-length-of-SM2-plaintext-give.patch
CVE-2021-3711-2-Extend-tests-for-SM2-decryption.patch
CVE-2021-3711-3-Check-the-plaintext-buffer-is-large-enough-when-decr.patch
- The function X509_aux_print() has a bug which may cause a read buffer overrun
when printing certificate details. A malicious actor could construct a
certificate to deliberately hit this bug, which may result in a crash of the
application (causing a Denial of Service attack).
* CVE-2021-3712
* bsc#1189521
* Add CVE-2021-3712-Fix-read-buffer-overrun-in-X509_aux_print.patch - Don't list disapproved cipher algorithms while in FIPS mode
* openssl-1.1.1-fips_list_ciphers.patch
* bsc#1161276 - Fix NULL pointer deref in signature_algorithms
* CVE-2021-3449
* bsc#1183852
* Add openssl-1_1-CVE-2021-3449-NULL_pointer_deref_in_signature_algorithms.patch - Security fixes:
* Integer overflow in CipherUpdate: Incorrect SSLv2 rollback
protection [bsc#1182333, CVE-2021-23840]
* Null pointer deref in X509_issuer_and_serial_hash()
[bsc#1182331, CVE-2021-23841]
- Add openssl-CVE-2021-23840.patch openssl-CVE-2021-23841.patch - Fix unresolved error codes [bsc#1182959]
- Update openssl-1.1.1-fips.patch - Fix EDIPARTYNAME NULL pointer dereference
(CVE-2020-1971, bsc#1179491)
* add openssl-CVE-2020-1971.patch - Restore private key check in EC_KEY_check_key [bsc#1177479]
* Update openssl-DH.patch - Add shared secret KAT to FIPS DH selftest [bsc#1175844]
* add openssl-fips-DH_selftest_shared_secret_KAT.patch - Include ECDH/DH Requirements from SP800-56Arev3 [bsc#1175844, bsc#1173470]
- Add patches:
* openssl-DH.patch
* openssl-kdf-selftest.patch
* openssl-kdf-tls-selftest.patch
* openssl-kdf-ssh-selftest.patch - Security fix: [bsc#1169407, CVE-2020-1967]
* Segmentation fault in SSL_check_chain: Server applications that
call the SSL_check_chain() function during or after a TLS handshake
may crash due to a NULL pointer dereference as a result of incorrect
handling of the signature_algorithms_cert TLS extension.
- Add patches:
* openssl-CVE-2020-1967.patch
* openssl-CVE-2020-1967-test1.patch
* openssl-CVE-2020-1967-test2.patch
* openssl-CVE-2020-1967-test3.patch - openssl dgst: default to SHA256 only when called without a digest,
not when it couldn't be found (bsc#1166189)
* add openssl-unknown_dgst.patch - Limit the DRBG selftests to not deplete entropy (bsc#1165274)
* update openssl-fips_selftest_upstream_drbg.patch - Run FIPS DRBG selftests against the crypto/rand DRBG implementation
(bsc#1164557)
* add openssl-fips_selftest_upstream_drbg.patch - Use the newly build libcrypto shared library when computing the hmac
checksums in order to avoid a bootstrapping issue by BuildRequiring
libopenssl1_1 (bsc#1164102) - Fix wrong return values of FIPS DSA and ECDH selftests (bsc#1163569)
* add openssl-fips_fix_selftests_return_value.patch - Added SHA3 FIPS self-tests bsc#1155345
* openssl-fips-add-SHA3-selftest.patch - Support for CPACF enhancements - part 2 (crypto) [jsc#SLE-7403]
- Add patches:
* openssl-s390x-assembly-pack-accelerate-X25519-X448-Ed25519-and-Ed448.patch
* openssl-s390x-fix-x448-and-x448-test-vector-ctime-for-x25519-and-x448.patch - Temporarily ignore broken OPENSSL_INIT_NO_ATEXIT due to our
layered FIPS initialization (bsc#1161789)
* openssl-fips-ignore_broken_atexit_test.patch - Import FIPS patches from SLE-15
* openssl-fips-dont_run_FIPS_module_installed.patch
* openssl-fips_mode.patch
* openssl-ship_fips_standalone_hmac.patch
* openssl-fips-clearerror.patch
* openssl-fips-selftests_in_nonfips_mode.patch - Don't run FIPS power-up self-tests when the checksum files aren't
installed (bsc#1042392)
* add openssl-fips-run_selftests_only_when_module_is_complete.patch - Import FIPS patches from Fedora (bsc#1157702, jsc#SLE-9553)
* openssl-1.1.1-fips-crng-test.patch
* openssl-1.1.1-fips-post-rand.patch
* openssl-1.1.1-fips.patch
* openssl-1.1.0-issuer-hash.patch
* openssl-1.1.1-evp-kdf.patch
* openssl-1.1.1-ssh-kdf.patch replaces openssl-jsc-SLE-8789-backport_KDF.patch
- keep EVP_KDF functions at version 1.1.1d for backward compatibility
* add openssl-keep_EVP_KDF_functions_version.patch - Support for CPACF enhancements - part 1 (crypto) [bsc#1152695, jsc#SLE-7861]
- Add patches:
* openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
* openssl-s390x-assembly-pack-add-support-for-pcc-and-kma-inst.patch
* openssl-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
* openssl-s390x-assembly-pack-update-OPENSSL_s390xcap-3.patch
* openssl-s390xcpuid.pl-fix-comment.patch
* openssl-assembly-pack-accelerate-scalar-multiplication.patch
* openssl-Enable-curve-spefific-ECDSA-implementations-via-EC_M.patch
* openssl-s390x-assembly-pack-accelerate-ECDSA.patch
* openssl-OPENSSL_s390xcap.pod-list-msa9-facility-bit-155.patch
* openssl-s390x-assembly-pack-cleanse-only-sensitive-fields.patch
* openssl-s390x-assembly-pack-fix-OPENSSL_s390xcap-z15-cpu-mas.patch
* openssl-s390x-assembly-pack-fix-msa3-stfle-bit-detection.patch
* openssl-Fix-9bf682f-which-broke-nistp224_method.patch - Obsolete libopenssl-1_0_0-devel and libopenssl-1_0_0-hmac in order
to avoid conflict upon upgrade from SLE-12 (bsc#1158499) - Security fix: [bsc#1158809, CVE-2019-1551]
* Overflow bug in the x64_64 Montgomery squaring procedure used
in exponentiation with 512-bit moduli
- Add openssl-1_1-CVE-2019-1551.patch - Fixed EVP_PBE_scrypt() to allow NULL salt values.
* Revealed by nodejs12 during bsc#1149572.
* Modified openssl-jsc-SLE-8789-backport_KDF.patch - Update to 1.1.1d (bsc#1133925, jsc#SLE-6430)
* Fixed a fork protection issue. OpenSSL 1.1.1 introduced a rewritten random
number generator (RNG). This was intended to include protection in the
event of a fork() system call in order to ensure that the parent and child
processes did not share the same RNG state. However this protection was not
being used in the default case.
(bsc#1150247, CVE-2019-1549)
* Compute ECC cofactors if not provided during EC_GROUP construction. Before
this change, EC_GROUP_set_generator would accept order and/or cofactor as
NULL. After this change, only the cofactor parameter can be NULL.
(bsc#1150003, CVE-2019-1547)
* Fixed a padding oracle in PKCS7_dataDecode and CMS_decrypt_set1_pkey.
(bsc#1150250, CVE-2019-1563)
* For built-in EC curves, ensure an EC_GROUP built from the curve name is
used even when parsing explicit parameters, when loading a serialized key
or calling EC_GROUP_new_from_ecpkparameters()/EC_GROUP_new_from_ecparameters().
* Early start up entropy quality from the DEVRANDOM seed source has been
improved for older Linux systems.
* Changed DH_check to accept parameters with order q and 2q subgroups.
With order 2q subgroups the bit 0 of the private key is not secret
but DH_generate_key works around that by clearing bit 0 of the
private key for those. This avoids leaking bit 0 of the private key.
* Significantly reduce secure memory usage by the randomness pools.
* Revert the DEVRANDOM_WAIT feature for Linux systems
- drop 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch (upstream)
- refresh patches
* openssl-1.1.0-no-html.patch
* openssl-jsc-SLE-8789-backport_KDF.patch - To avoid seperate certification of openssh server / client
move the SSH KDF (Key Derivation Function) into openssl.
* jsc#SLE-8789
* Sourced from commit
8d76481b189b7195ef932e0fb8f0e23ab0120771#diff-a9562bc75317360a2e6b8b0748956e34
in openssl master (introduce the SSH KDF)
and commit 5a285addbf39f91d567f95f04b2b41764127950d
in openssl master (backport EVP/KDF API framework)
* added openssl-jsc-SLE-8789-backport_KDF.patch - Upgrade to 1.1.1c (jsc#SLE-9135, bsc#1148799)
* Support for TLSv1.3 added
* Allow GNU style "make variables" to be used with Configure.
* Add a STORE module (OSSL_STORE)
* Claim the namespaces OSSL and OPENSSL, represented as symbol prefixes
* Add multi-prime RSA (RFC 8017) support
* Add SM3 implemented according to GB/T 32905-2016
* Add SM4 implemented according to GB/T 32907-2016.
* Add 'Maximum Fragment Length' TLS extension negotiation and support
* Add ARIA support
* Add SHA3
* Rewrite of devcrypto engine
* Add support for SipHash
* Grand redesign of the OpenSSL random generator
- drop FIPS support
* don't build with FIPS mode (not supported in 1.1.1)
- drop FIPS patches
* openssl-fips-clearerror.patch
* openssl-fips_disallow_ENGINE_loading.patch
* openssl-fips-dont-fall-back-to-default-digest.patch
* openssl-fips-dont_run_FIPS_module_installed.patch
* openssl-fips-fix-odd-rsakeybits.patch
* openssl-fips-rsagen-d-bits.patch
* openssl-fips-selftests_in_nonfips_mode.patch
* openssl-rsakeygen-minimum-distance.patch
* openssl-1.1.0-fips.patch
- add TLS 1.3 ciphers to DEFAULT_SUSE
- merge openssl-1.0.1e-add-suse-default-cipher.patch and
openssl-1.0.1e-add-test-suse-default-cipher-suite.patch to
openssl-DEFAULT_SUSE_cipher.patch
- Use upstream patch for the locale crash (bsc#1135550)
* https://github.com/openssl/openssl/pull/8966
* add 0001-build_SYS_str_reasons-Fix-a-crash-caused-by-overlong.patch
- drop patches (upstream):
* openssl-Bleichenbachers_CAT.patch
* openssl-CVE-2018-0734.patch
* openssl-CVE-2018-0735.patch
* openssl-CVE-2019-1543.patch
* openssl-disable_rsa_keygen_tests_with_small_modulus.patch
* openssl-dsa_paramgen2_check.patch
* openssl-One_and_Done.patch
* openssl-speed_skip_binary_curves_NO_EC2M.patch
* openssl-static-deps.patch
* openssl-urandom-reseeding.patch
* 0001-Add-a-constant-time-flag-to-one-of-the-bignums-to-av.patch
* 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
* 0001-DSA-mod-inverse-fix.patch
* 0001-Resume-reading-from-randfile-when-interrupted-by-a-s.patch
* 0001-apps-speed-fix-segfault-while-looking-up-algorithm-n.patch
- drop s390x patches (rebased):
* 0002-s390x-assembly-pack-add-KMA-code-path-for-aes-ctr.patch
* 0003-crypto-aes-asm-aes-s390x.pl-replace-decrypt-flag-by-.patch
* 0004-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
* 0005-s390x-assembly-pack-add-KMAC-code-path-for-aes-ccm.patch
* 0006-s390x-assembly-pack-add-KM-code-path-for-aes-ecb.patch
* 0007-s390x-assembly-pack-add-KMO-code-path-for-aes-ofb.patch
* 0008-s390x-assembly-pack-add-KMF-code-path-for-aes-cfb-cf.patch
* 0009-Fix-undefined-behavior-in-s390x-aes-gcm-ccm.patch
* 0001-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch
* 0001-s390x-assembly-pack-extend-s390x-capability-vector.patch
- add s390x patches:
* 0001-s390x-assembly-pack-perlasm-support.patch
* 0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch
* 0003-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch
* 0004-s390x-assembly-pack-fix-formal-interface-bug-in-chac.patch
* 0005-s390x-assembly-pack-import-chacha-from-cryptogams-re.patch
* 0006-s390x-assembly-pack-import-poly-from-cryptogams-repo.patch - Fix segfault in openssl speed when an unknown algorithm is passed
(bsc#1125494)
* add 0001-apps-speed-fix-segfault-while-looking-up-algorithm-n.patch
- Correctly skip binary curves in openssl speed to avoid spitting
errors (bsc#1116833)
* add openssl-speed_skip_binary_curves_NO_EC2M.patch - OpenSSL Security Advisory [6 March 2019]
* Prevent long nonces in ChaCha20-Poly1305 (bsc#1128189, CVE-2019-1543)
* add openssl-CVE-2019-1543.patch - Add s390x poly1305 vectorized implementation (fate#326351)
* https://github.com/openssl/openssl/pull/7991
- add 0001-crypto-poly1305-asm-poly1305-s390x.pl-add-vx-code-pa.patch - Add vectorized chacha20 implementation for s390x (fate#326561)
* https://github.com/openssl/openssl/pull/6919
- add patches:
0001-s390x-assembly-pack-perlasm-support.patch
0002-crypto-chacha-asm-chacha-s390x.pl-add-vx-code-path.patch - Replace fate#321518 s390x patches from closed pull request
https://github.com/openssl/openssl/pull/2859 with patches from
openssl git master (bsc#1122984)
- add patches:
0001-s390x-assembly-pack-extend-s390x-capability-vector.patch
0002-s390x-assembly-pack-add-KMA-code-path-for-aes-ctr.patch
0003-crypto-aes-asm-aes-s390x.pl-replace-decrypt-flag-by-.patch
0004-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
0005-s390x-assembly-pack-add-KMAC-code-path-for-aes-ccm.patch
0006-s390x-assembly-pack-add-KM-code-path-for-aes-ecb.patch
0007-s390x-assembly-pack-add-KMO-code-path-for-aes-ofb.patch
0008-s390x-assembly-pack-add-KMF-code-path-for-aes-cfb-cf.patch
0009-Fix-undefined-behavior-in-s390x-aes-gcm-ccm.patch
- drop patches:
0002-crypto-modes-asm-ghash-s390x.pl-fix-gcm_gmult_4bit-K.patch
0004-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
0005-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
0006-s390x-assembly-pack-extended-s390x-capability-vector.patch
0007-crypto-evp-e_aes.c-add-foundations-for-extended-s390.patch
0008-s390x-assembly-pack-extended-s390x-capability-vector.patch
0009-crypto-aes-asm-aes-s390x.pl-add-KMA-code-path.patch
0010-doc-man3-OPENSSL_s390xcap.pod-update-KMA.patch
0011-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch
0012-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
0013-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch - Fix FIPS RSA generator (bsc#1118913)
* import fixed openssl-1.1.0-fips.patch from Fedora
* drop openssl-CVE-2018-0737-fips.patch which got merged into
openssl-1.1.0-fips.patch
* refresh openssl-fips-rsagen-d-bits.patch - The 9 Lives of Bleichenbacher's CAT: Cache ATtacks on TLS
Implementations (bsc#1117951)
* https://github.com/openssl/openssl/issues/7739
* add patch openssl-Bleichenbachers_CAT.patch - OpenSSL Security Advisory [30 October 2018]
* Timing vulnerability in ECDSA signature generation
(bsc#1113651, CVE-2018-0735)
* Timing vulnerability in DSA signature generation
(bsc#1113652, CVE-2018-0734)
* And more timing fixes
- Add patches:
* openssl-CVE-2018-0734.patch
* openssl-CVE-2018-0735.patch
* 0001-DSA-mod-inverse-fix.patch
* 0001-Add-a-constant-time-flag-to-one-of-the-bignums-to-av.patch - Obsolete libopenssl-1_0_0-devel by libopenssl-1_1-devel to avoid
conflicts when updating from older distributions (bsc#1106180) - Fix infinite loop in DSA generation with incorrect parameters
(bsc#1112209)
* add openssl-dsa_paramgen2_check.patch - Fix One&Done side-channel attack on RSA (bsc#1104789)
* add openssl-One_and_Done.patch - Update to 1.1.0i
- Align with SLE-12-SP4
OpenSSL Security Advisory [12 June 2018]
* Reject excessively large primes in DH key generation
(bsc#1097158, CVE-2018-0732)
* Make EVP_PKEY_asn1_new() a bit stricter about its input
* Revert blinding in ECDSA sign and instead make problematic addition
length-invariant. Switch even to fixed-length Montgomery multiplication.
* Change generating and checking of primes so that the error rate of not
being prime depends on the intended use based on the size of the input.
* Increase the number of Miller-Rabin rounds for DSA key generating to 64.
* Add blinding to ECDSA and DSA signatures to protect against side channel
attacks
* When unlocking a pass phrase protected PEM file or PKCS#8 container, we
now allow empty (zero character) pass phrases.
* Certificate time validation (X509_cmp_time) enforces stricter
compliance with RFC 5280. Fractional seconds and timezone offsets
are no longer allowed.
* Fixed a text canonicalisation bug in CMS
- drop patches (upstream):
* 0001-Limit-scope-of-CN-name-constraints.patch
* 0001-Revert-util-dofile.pl-only-quote-stuff-that-actually.patch
* 0001-Tolerate-a-Certificate-using-a-non-supported-group-o.patch
* 0002-Skip-CN-DNS-name-constraint-checks-when-not-needed.patch
* openssl-add-blinding-to-dsa.patch
* openssl-add-blinding-to-ecdsa.patch
* openssl-CVE-2018-0732.patch
- refresh patches:
* openssl-1.1.0-fips.patch
* openssl-disable_rsa_keygen_tests_with_small_modulus.patch
- rename openssl-CVE-2018-0737.patch to openssl-CVE-2018-0737-fips.patch
as it now only includes changes to the fips code - Add openssl(cli) Provide so the packages that require the openssl
binary can require this instead of the new openssl meta package
(bsc#1101470)
- Don't Require openssl-1_1 from the devel package, just Recommend it - Suggest libopenssl1_1-hmac from libopenssl1_1 package to avoid
dependency issues during updates (bsc#1090765) - Relax CN name restrictions (bsc#1084011)
* added patches:
0001-Limit-scope-of-CN-name-constraints.patch
0002-Skip-CN-DNS-name-constraint-checks-when-not-needed.patch - Reject excessively large primes in DH key generation (bsc#1097158,
CVE-2018-0732)
* openssl-CVE-2018-0732.patch
- blinding enhancements for ECDSA and DSA (bsc#1097624, bsc#1098592)
* openssl-add-blinding-to-ecdsa.patch
* openssl-add-blinding-to-dsa.patch - OpenSSL Security Advisory [16 Apr 2018]
* Cache timing vulnerability in RSA Key Generation
(CVE-2018-0737, bsc#1089039)
* add openssl-CVE-2018-0737.patch - Fix escaping in c_rehash (boo#1091961, bsc#1091963)
* add 0001-Revert-util-dofile.pl-only-quote-stuff-that-actually.patch - Tolerate a Certificate using a non-supported group on server side
(boo#1084651)
* https://github.com/openssl/openssl/pull/5607
* add 0001-Tolerate-a-Certificate-using-a-non-supported-group-o.patch - Update to 1.1.0h
OpenSSL Security Advisory [27 Mar 2018]
* Constructed ASN.1 types with a recursive definition could exceed
the stack (CVE-2018-0739) (bsc#1087102)
* rsaz_1024_mul_avx2 overflow bug on x86_64 (CVE-2017-3738)
(bsc#1071906)
- refresh patches:
* 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
* openssl-1.1.0-fips.patch
* openssl-pkgconfig.patch
* openssl-rsakeygen-minimum-distance.patch
* openssl-static-deps.patch - Move the libopenssl1_1_0-32bit obsoletes in baselibs.conf to the
new libopenssl1_1-32bit: it does not belong to the devel
package. - Renamed from openssl-1_1_0 (bsc#1081335)
* All the minor versions of the 1.1.x openssl branch have the same
sonum and keep ABI compatibility
* obsolete the 1_1_0 packages
- update baselibs.conf with the new version names - Remove bit obsolete syntax
- Use %license macro - Don't disable afalgeng on aarch64 - Add support for s390x CPACF enhancements (fate#321518)
patches taken from https://github.com/openssl/openssl/pull/2859:
* 0002-crypto-modes-asm-ghash-s390x.pl-fix-gcm_gmult_4bit-K.patch
* 0004-s390x-assembly-pack-add-OPENSSL_s390xcap-environment.patch
* 0005-s390x-assembly-pack-add-OPENSSL_s390xcap-man-page.patch
* 0006-s390x-assembly-pack-extended-s390x-capability-vector.patch
* 0007-crypto-evp-e_aes.c-add-foundations-for-extended-s390.patch
* 0008-s390x-assembly-pack-extended-s390x-capability-vector.patch
* 0009-crypto-aes-asm-aes-s390x.pl-add-KMA-code-path.patch
* 0010-doc-man3-OPENSSL_s390xcap.pod-update-KMA.patch
* 0011-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch
* 0012-s390x-assembly-pack-add-KMA-code-path-for-aes-gcm.patch
* 0013-crypto-aes-asm-aes-s390x.pl-add-CFI-annotations-KMA-.patch - Do not filter pkgconfig() provides/requires. - Obsolete openssl-1_0_0 by openssl-1_1_0: this is required for a
clean upgrade path as an aid to zypp (boo#1070003). - Update to 1.1.0g
OpenSSL Security Advisory [02 Nov 2017]
* bn_sqrx8x_internal carry bug on x86_64
(CVE-2017-3736) (bsc#1066242)
* Malformed X.509 IPAddressFamily could cause OOB read
(CVE-2017-3735) (bsc#1056058)
- drop 0001-Fix-a-TLSProxy-race-condition.patch (upstream)
- refresh 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch - update DEFAULT_SUSE cipher list (bsc#1055825)
* add CHACHA20-POLY1305
* add ECDSA ciphers
* remove 3DES
- modified openssl-1.0.1e-add-suse-default-cipher.patch - do not require openssl1_1_0-targettype in devel-targettype, as it
is not built (it has no libraries) - The description is supposed to describe the package, not the
development process or history. (Synchronize with the
already-updates descriptions in openssl-1_0_0.)
- Update historic copypasted boilerplate summaries
("include files mandatory for development") - Disable the verbosity of the tests as we expose yet another race
condition in that - Fix a race condition in tests to make the package build reliably
* https://github.com/openssl/openssl/issues/3562
* 0001-Fix-a-TLSProxy-race-condition.patch - Add Provides and Conflicts for -devel package in baselibs.conf. - Add patch openssl-no-date.patch to disable date inclusion in most
of the binaries
- Use autopatch to make things smaller
- Enable verbose output on the tests
- Paralelize depmod - update to 1.1.0f
* bugfix only release
- disable RSA keygen tests, because they use too small modulus, which
is rejected by our CC/FIPS hardening patches
* added openssl-disable_rsa_keygen_tests_with_small_modulus.patch
- refreshed openssl-rsakeygen-minimum-distance.patch and
0001-Axe-builtin-printf-implementation-use-glibc-instead.patch - Add conflict for any libopenssl-devel that is not in our version - Avoid the requires conflict between 1.1 and 1.0 openssl - Add conflict on docu packages - drop unnecessary README.SUSE - add openssl-1.1-fix-ppc64.patch from Marcus Meissner to fix build
on ppc64 - Fix build on aarch64 - Remove libpadlock conditional, no longer present - Update baselibs.conf to contain all the renamed packages - re-enable tests on SLE-12 and below despite current failure, so
they are automatically run once the issue is resolved - Filter out the pkgconfig provides to force usage of the main
openssl package provides - disable tests on SLE-12 and its derivates
* they fail because of glibc bug bsc#1035445
- remove README-FIPS.txt (outdated) - drop openssl-fipslocking.patch
The locking in 1.1.0 has been rewritten and converted to the new
threading API. The fips deadlock (at least bsc#991193) can't be
reproduced anymore.
- don't ship useless INSTALL* files - simplify openssl-fips-dont-fall-back-to-default-digest.patch
The -non-fips-allow option was dropped in OpenSSL 1.1.0
- drop openssl-no-egd.patch as OpenSSL 1.1.0 disables EGD at compile
time by default
- renumber the patches so the numbers are consequent - Update showciphers.c to work with new openssl - Add patch openssl-static-deps.patch to allow dependencies on
statically build libraries
- Refresh openssl-1-1.0-fips.patch to take in use the above approach
- Silence the install manpage rename phase - Start update to 1.1.0e basing of the 1.0.0 split release
- Drop patch merge_from_0.9.8k.patch the ppc64 should work out of the
box
- Drop patch openssl-engines-path.patch converted to configure option
- Drop patch openssl-1.0.2a-padlock64.patch code behind was redone
does not apply at all
- Drop patch openssl-fix-pod-syntax.diff mostly merged upstream or
not applicable
- Drop patch compression_methods_switch.patch as we do not need
to keep the compat on this release anymore
- Drop patch openssl-1.0.2a-ipv6-apps.patch which was upstreamed
- Drop upstreamed patch openssl-1.0.2a-default-paths.patch
- Drop obsolete patch openssl-1.0.0-c_rehash-compat.diff
- Drop obsolete patch openssl-missing_FIPS_ec_group_new_by_curve_name.patch
- Drop obsolete patch openssl-print_notice-NULL_crash.patch
- Drop obsolete patch openssl-randfile_fread_interrupt.patch
- Refresh patch openssl-truststore.patch
- Refresh baselibs.conf to correctly reflect soname
- Add patch openssl-1.1.0-fips.patch obsoleting bunch of older:
* openssl-1.0.2i-fips.patch
* openssl-1.0.2a-fips-ec.patch
* openssl-1.0.2a-fips-ctor.patch
* openssl-1.0.2i-new-fips-reqs.patch
* openssl-fips_disallow_x931_rand_method.patch
- Add new patch for upstream:
* 0001-Resume-reading-from-randfile-when-interrupted-by-a-s.patch
- Refresh patch openssl-pkgconfig.patch
- Drop patch openssl-gcc-attributes.patch as the code was redone
- Rebase patch 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
- Rebase patch openssl-no-egd.patch
- Rebase patch openssl-1.0.1e-add-suse-default-cipher.patch and
openssl-1.0.1e-add-test-suse-default-cipher-suite.patch
- Rebase patch openssl-fips_disallow_ENGINE_loading.patch
- Rebase patch openssl-urandom-reseeding.patch
- Rebase patch openssl-fips-rsagen-d-bits.patch
- Rebase patch openssl-fips-selftests_in_nonfips_mode.patch
- Remove switch for ssl2 - no longer present
- Remve the buildinf.h parsing, should no longer be needed
- Drop the rehash in build, no longer needed
- Drop openssl-fips-hidden.patch as it is not really needed
- Do not sed in secure_getenv upstream does it in code on their own
- Do not install html converted manpages
* openssl-1.1.0-no-html.patch - Drop the symbol hiding patches to ease maintenance updates:
* 0005-libssl-Hide-library-private-symbols.patch
* 0001-libcrypto-Hide-library-private-symbols.patch - Add new patch for engines folders to allow co-installation
* openssl-engines-path.patch - Drop openssl-ocloexec.patch as it causes additional maintenance
burden we would like to avoid - Drop bug610223.patch as we moved to libdir - Move check to %check phase
- Split showciphers to separate file - Move openssl to /usr/lib64 from /lib64 - Remove some of the DSO setting code that is not needed
- Fix the showciphers binary - Rename to openssl-1_0_0 to allow instalation of multiple versions - Remove O3 from optflags, no need to not rely on distro wide settings
- Remove conditions for sle10 and sle11, we care only about sle12+
- USE SUSE instead of SuSE in readme
- Pass over with spec-cleaner - fix X509_CERT_FILE path (bsc#1022271) and rename
updated openssl-1.0.1e-truststore.diff to openssl-truststore.patch - Updated to openssl 1.0.2k
- bsc#1009528 / CVE-2016-7055: openssl: Montgomery multiplication may produce incorrect results
- bsc#1019334 / CVE-2016-7056: openssl: ECSDA P-256 timing attack key recovery
- bsc#1022085 / CVE-2017-3731: openssl: Truncated packet could crash via OOB read
- bsc#1022086 / CVE-2017-3732: openssl: BN_mod_exp may produce incorrect results on x86_64 - resume reading from /dev/urandom when interrupted by a signal
(bsc#995075)
* add openssl-randfile_fread_interrupt.patch - add FIPS changes from SP2:
- fix problems with locking in FIPS mode (bsc#992120)
* duplicates: bsc#991877, bsc#991193, bsc#990392, bsc#990428
and bsc#990207
* bring back openssl-fipslocking.patch
- drop openssl-fips_RSA_compute_d_with_lcm.patch (upstream)
(bsc#984323)
- don't check for /etc/system-fips (bsc#982268)
* add openssl-fips-dont_run_FIPS_module_installed.patch
- refresh openssl-fips-rsagen-d-bits.patch - update to openssl-1.0.2j
* Missing CRL sanity check (CVE-2016-7052 bsc#1001148) - OpenSSL Security Advisory [22 Sep 2016] (bsc#999665)
Severity: High
* OCSP Status Request extension unbounded memory growth
(CVE-2016-6304) (bsc#999666)
Severity: Low
* Pointer arithmetic undefined behaviour (CVE-2016-2177) (bsc#982575)
* Constant time flag not preserved in DSA signing (CVE-2016-2178) (bsc#983249)
* DTLS buffered message DoS (CVE-2016-2179) (bsc#994844)
* OOB read in TS_OBJ_print_bio() (CVE-2016-2180) (bsc#990419)
* DTLS replay protection DoS (CVE-2016-2181) (bsc#994749)
* OOB write in BN_bn2dec() (CVE-2016-2182) (bsc#993819)
* Birthday attack against 64-bit block ciphers (SWEET32)
(CVE-2016-2183) (bsc#995359)
* Malformed SHA512 ticket DoS (CVE-2016-6302) (bsc#995324)
* OOB write in MDC2_Update() (CVE-2016-6303) (bsc#995377)
* Certificate message OOB reads (CVE-2016-6306) (bsc#999668)
- update to openssl-1.0.2i
* remove patches:
openssl-1.0.2a-new-fips-reqs.patch
openssl-1.0.2e-fips.patch
* add patches:
openssl-1.0.2i-fips.patch
openssl-1.0.2i-new-fips-reqs.patch - fix crash in print_notice (bsc#998190)
* add openssl-print_notice-NULL_crash.patch - OpenSSL Security Advisory [3rd May 2016]
- update to 1.0.2h (boo#977584, boo#977663)
* Prevent padding oracle in AES-NI CBC MAC check
A MITM attacker can use a padding oracle attack to decrypt traffic
when the connection uses an AES CBC cipher and the server support
AES-NI.
(CVE-2016-2107, boo#977616)
* Fix EVP_EncodeUpdate overflow
An overflow can occur in the EVP_EncodeUpdate() function which is used for
Base64 encoding of binary data. If an attacker is able to supply very large
amounts of input data then a length check can overflow resulting in a heap
corruption.
(CVE-2016-2105, boo#977614)
* Fix EVP_EncryptUpdate overflow
An overflow can occur in the EVP_EncryptUpdate() function. If an attacker
is able to supply very large amounts of input data after a previous call to
EVP_EncryptUpdate() with a partial block then a length check can overflow
resulting in a heap corruption.
(CVE-2016-2106, boo#977615)
* Prevent ASN.1 BIO excessive memory allocation
When ASN.1 data is read from a BIO using functions such as d2i_CMS_bio()
a short invalid encoding can casuse allocation of large amounts of memory
potentially consuming excessive resources or exhausting memory.
(CVE-2016-2109, boo#976942)
* EBCDIC overread
ASN1 Strings that are over 1024 bytes can cause an overread in applications
using the X509_NAME_oneline() function on EBCDIC systems. This could result
in arbitrary stack data being returned in the buffer.
(CVE-2016-2176, boo#978224)
* Modify behavior of ALPN to invoke callback after SNI/servername
callback, such that updates to the SSL_CTX affect ALPN.
* Remove LOW from the DEFAULT cipher list. This removes singles DES from the
default.
* Only remove the SSLv2 methods with the no-ssl2-method option. When the
methods are enabled and ssl2 is disabled the methods return NULL. - Remove a hack for bsc#936563
- Drop bsc936563_hack.patch - import fips patches from SLE-12
* openssl-fips-clearerror.patch
* openssl-fips-dont-fall-back-to-default-digest.patch
* openssl-fips-fix-odd-rsakeybits.patch
* openssl-fips-rsagen-d-bits.patch
* openssl-fips-selftests_in_nonfips_mode.patch
* openssl-fips_RSA_compute_d_with_lcm.patch
* openssl-fips_disallow_ENGINE_loading.patch
* openssl-fips_disallow_x931_rand_method.patch
* openssl-rsakeygen-minimum-distance.patch
* openssl-urandom-reseeding.patch - add support for "ciphers" providing no encryption (bsc#937085)
* don't build with -DSSL_FORBID_ENULL - update to 1.0.2g (bsc#968044)
* Disable weak ciphers in SSLv3 and up in default builds of OpenSSL.
Builds that are not configured with "enable-weak-ssl-ciphers" will not
provide any "EXPORT" or "LOW" strength ciphers.
* Disable SSLv2 default build, default negotiation and weak ciphers. SSLv2
is by default disabled at build-time. Builds that are not configured with
"enable-ssl2" will not support SSLv2. Even if "enable-ssl2" is used,
users who want to negotiate SSLv2 via the version-flexible SSLv23_method()
will need to explicitly call either of:
SSL_CTX_clear_options(ctx, SSL_OP_NO_SSLv2);
or
SSL_clear_options(ssl, SSL_OP_NO_SSLv2);
(CVE-2016-0800)
* Fix a double-free in DSA code
(CVE-2016-0705)
* Disable SRP fake user seed to address a server memory leak.
Add a new method SRP_VBASE_get1_by_user that handles the seed properly.
(CVE-2016-0798)
* Fix BN_hex2bn/BN_dec2bn NULL pointer deref/heap corruption
(CVE-2016-0797)
* ) Side channel attack on modular exponentiation
http://cachebleed.info.
(CVE-2016-0702)
* ) Change the req app to generate a 2048-bit RSA/DSA key by default,
if no keysize is specified with default_bits. This fixes an
omission in an earlier change that changed all RSA/DSA key generation
apps to use 2048 bits by default. - update to 1.0.2f (boo#963410)
* ) DH small subgroups (boo#963413)
Historically OpenSSL only ever generated DH parameters based on "safe"
primes. More recently (in version 1.0.2) support was provided for
generating X9.42 style parameter files such as those required for RFC 5114
support. The primes used in such files may not be "safe". Where an
application is using DH configured with parameters based on primes that are
not "safe" then an attacker could use this fact to find a peer's private
DH exponent. This attack requires that the attacker complete multiple
handshakes in which the peer uses the same private DH exponent. For example
this could be used to discover a TLS server's private DH exponent if it's
reusing the private DH exponent or it's using a static DH ciphersuite.
(CVE-2016-0701)
* ) SSLv2 doesn't block disabled ciphers (boo#963415)
A malicious client can negotiate SSLv2 ciphers that have been disabled on
the server and complete SSLv2 handshakes even if all SSLv2 ciphers have
been disabled, provided that the SSLv2 protocol was not also disabled via
SSL_OP_NO_SSLv2.
(CVE-2015-3197)
* ) Reject DH handshakes with parameters shorter than 1024 bits. - update to 1.0.2e
* fixes five security vulnerabilities
* Anon DH ServerKeyExchange with 0 p parameter
(CVE-2015-1794) (bsc#957984)
* BN_mod_exp may produce incorrect results on x86_64
(CVE-2015-3193) (bsc#957814)
* Certificate verify crash with missing PSS parameter
(CVE-2015-3194) (bsc#957815)
* X509_ATTRIBUTE memory leak
(CVE-2015-3195) (bsc#957812)
* Race condition handling PSK identify hint
(CVE-2015-3196) (bsc#957813)
- pulled a refreshed fips patch from Fedora
* openssl-1.0.2a-fips.patch was replaced by
openssl-1.0.2e-fips.patch
- refresh openssl-ocloexec.patch - update to 1.0.2d
* fixes CVE-2015-1793 (bsc#936746)
Alternate chains certificate forgery
During certificate verfification, OpenSSL will attempt to find an
alternative certificate chain if the first attempt to build such a chain
fails. An error in the implementation of this logic can mean that an
attacker could cause certain checks on untrusted certificates to be
bypassed, such as the CA flag, enabling them to use a valid leaf
certificate to act as a CA and "issue" an invalid certificate.
- drop openssl-fix_invalid_manpage_name.patch (upstream) - Workaround debugit crash on ppc64le with gcc5
bsc936563_hack.patch (bsc#936563) - update merge_from_0.9.8k.patch replacing __LP64__ by __LP64
this is a change versus previous request 309611
required to avoid build error for ppc64 - Build with no-ssl3, for details on why this is needed read
rfc7568. Contrary to the "no-ssl2" option, this does not
require us to patch dependant packages as the relevant
functions are still available (SSLv3_(client|server)_method)
but will fail to negotiate. if removing SSL3 methods is desired
at a later time, option "no-ssl3-method" needs to be used. - update to 1.0.2c
* Fix HMAC ABI incompatibility
- refreshed openssl-1.0.2a-fips.patch - update to 1.0.2b
* Malformed ECParameters causes infinite loop (CVE-2015-1788)
* Exploitable out-of-bounds read in X509_cmp_time (CVE-2015-1789)
* PKCS7 crash with missing EnvelopedContent (CVE-2015-1790)
* CMS verify infinite loop with unknown hash function (CVE-2015-1792)
* Race condition handling NewSessionTicket (CVE-2015-1791)
- refreshed patches:
* 0001-Axe-builtin-printf-implementation-use-glibc-instead.patch
* 0001-libcrypto-Hide-library-private-symbols.patch
* openssl-1.0.2a-default-paths.patch
* openssl-1.0.2a-fips.patch
* compression_methods_switch.patch
* openssl-1.0.1e-add-test-suse-default-cipher-suite.patch - update to 1.0.2a
* Major changes since 1.0.1:
- Suite B support for TLS 1.2 and DTLS 1.2
- Support for DTLS 1.2
- TLS automatic EC curve selection.
- API to set TLS supported signature algorithms and curves
- SSL_CONF configuration API.
- TLS Brainpool support.
- ALPN support.
- CMS support for RSA-PSS, RSA-OAEP, ECDH and X9.42 DH.
- packaging changes:
* merged patches modifying CIPHER_LIST into one, dropping:
- openssl-1.0.1e-add-suse-default-cipher-header.patch
- openssl-libssl-noweakciphers.patch
* fix a manpage with invalid name
- added openssl-fix_invalid_manpage_name.patch
* remove a missing fips function
- openssl-missing_FIPS_ec_group_new_by_curve_name.patch
* reimported patches from Fedora
dropped patches:
- openssl-1.0.1c-default-paths.patch
- openssl-1.0.1c-ipv6-apps.patch
- openssl-1.0.1e-fips-ctor.patch
- openssl-1.0.1e-fips-ec.patch
- openssl-1.0.1e-fips.patch
- openssl-1.0.1e-new-fips-reqs.patch
- VIA_padlock_support_on_64systems.patch
added patches:
- openssl-1.0.2a-default-paths.patch
- openssl-1.0.2a-fips-ctor.patch
- openssl-1.0.2a-fips-ec.patch
- openssl-1.0.2a-fips.patch
- openssl-1.0.2a-ipv6-apps.patch
- openssl-1.0.2a-new-fips-reqs.patch
- openssl-1.0.2a-padlock64.patch
* dropped security fixes (upstream)
- openssl-CVE-2015-0209.patch
- openssl-CVE-2015-0286.patch
- openssl-CVE-2015-0287.patch
- openssl-CVE-2015-0288.patch
- openssl-CVE-2015-0289.patch
- openssl-CVE-2015-0293.patch
* upstream reformatted the sources, so all the patches have to
be refreshed - security update:
* CVE-2015-0209 (bnc#919648)
- Fix a failure to NULL a pointer freed on error
* CVE-2015-0286 (bnc#922496)
- Segmentation fault in ASN1_TYPE_cmp
* CVE-2015-0287 (bnc#922499)
- ASN.1 structure reuse memory corruption
* CVE-2015-0288 x509: (bnc#920236)
- added missing public key is not NULL check
* CVE-2015-0289 (bnc#922500)
- PKCS7 NULL pointer dereferences
* CVE-2015-0293 (bnc#922488)
- Fix reachable assert in SSLv2 servers
* added patches:
openssl-CVE-2015-0209.patch
openssl-CVE-2015-0286.patch
openssl-CVE-2015-0287.patch
openssl-CVE-2015-0288.patch
openssl-CVE-2015-0289.patch
openssl-CVE-2015-0293.patch - The DATE stamp moved from crypto/Makefile to crypto/buildinf.h,
replace it there (bsc#915947) - openssl 1.0.1k release
bsc#912294 CVE-2014-3571: Fix DTLS segmentation fault in dtls1_get_record.
bsc#912292 CVE-2015-0206: Fix DTLS memory leak in dtls1_buffer_record.
bsc#911399 CVE-2014-3569: Fix issue where no-ssl3 configuration sets method to NULL.
bsc#912015 CVE-2014-3572: Abort handshake if server key exchange
message is omitted for ephemeral ECDH ciphersuites.
bsc#912014 CVE-2015-0204: Remove non-export ephemeral RSA code on client and server.
bsc#912293 CVE-2015-0205: Fixed issue where DH client certificates are accepted without verification.
bsc#912018 CVE-2014-8275: Fix various certificate fingerprint issues.
bsc#912296 CVE-2014-3570: Correct Bignum squaring.
and other bugfixes.
- openssl.keyring: use Matt Caswells current key.
pub 2048R/0E604491 2013-04-30
uid Matt Caswell
uid Matt Caswell
sub 2048R/E3C21B70 2013-04-30
- openssl-1.0.1e-fips.patch: rediffed
- openssl-1.0.1i-noec2m-fix.patch: removed (upstream)
- openssl-ocloexec.patch: rediffed - suse_version 10.1 & 10.2 x86_64 can not enable-ec_nistp_64_gcc_128 - openssl-1.0.1i-noec2m-fix.patch: only report the Elliptic Curves
we actually support (not the binary ones) (bnc#905037) - openSUSE < 11.2 doesn't have accept4() - openSSL 1.0.1j
* Fix SRTP Memory Leak (CVE-2014-3513)
* Session Ticket Memory Leak (CVE-2014-3567)
* Add SSL 3.0 Fallback protection (TLS_FALLBACK_SCSV)
* Build option no-ssl3 is incomplete (CVE-2014-3568) openssl-1_0_0 openssl-1_1_0 h02-armsrv3 1707134886
! " # $ % & ' ( ) * + , - . / 0 1 2 3 4 5 6 7 8 9 : ; < = > ? @ A B C D E F G H I J K L M N O P Q R S T U V W X Y Z [ \ ] ^ _ ` a b c d e f g h i j k l m n o p q r s t u v w 1.1.1l-150400.7.63.1 1.1.1l-150400.7.63.1 1.1.1l-150400.7.63.1 ssl ct_log_list.cnf ct_log_list.cnf.dist engdef.d engines.d openssl.cnf private c_rehash fips_standalone_hmac openssl openssl-1_1 CHANGES NEWS README CA.pl.1ssl.gz asn1parse.1ssl.gz c_rehash.1ssl.gz ca.1ssl.gz ciphers.1ssl.gz cms.1ssl.gz crl.1ssl.gz crl2pkcs7.1ssl.gz dgst.1ssl.gz dhparam.1ssl.gz dsa.1ssl.gz dsaparam.1ssl.gz ec.1ssl.gz ecparam.1ssl.gz enc.1ssl.gz engine.1ssl.gz errstr.1ssl.gz gendsa.1ssl.gz genpkey.1ssl.gz genrsa.1ssl.gz list.1ssl.gz nseq.1ssl.gz ocsp.1ssl.gz openssl-asn1parse.1ssl.gz openssl-c_rehash.1ssl.gz openssl-ca.1ssl.gz openssl-ciphers.1ssl.gz openssl-cms.1ssl.gz openssl-crl.1ssl.gz openssl-crl2pkcs7.1ssl.gz openssl-dgst.1ssl.gz openssl-dhparam.1ssl.gz openssl-dsa.1ssl.gz openssl-dsaparam.1ssl.gz openssl-ec.1ssl.gz openssl-ecparam.1ssl.gz openssl-enc.1ssl.gz openssl-engine.1ssl.gz openssl-errstr.1ssl.gz openssl-gendsa.1ssl.gz openssl-genpkey.1ssl.gz openssl-genrsa.1ssl.gz openssl-list.1ssl.gz openssl-nseq.1ssl.gz openssl-ocsp.1ssl.gz openssl-passwd.1ssl.gz openssl-pkcs12.1ssl.gz openssl-pkcs7.1ssl.gz openssl-pkcs8.1ssl.gz openssl-pkey.1ssl.gz openssl-pkeyparam.1ssl.gz openssl-pkeyutl.1ssl.gz openssl-prime.1ssl.gz openssl-rand.1ssl.gz openssl-rehash.1ssl.gz openssl-req.1ssl.gz openssl-rsa.1ssl.gz openssl-rsautl.1ssl.gz openssl-s_client.1ssl.gz openssl-s_server.1ssl.gz openssl-s_time.1ssl.gz openssl-sess_id.1ssl.gz openssl-smime.1ssl.gz openssl-speed.1ssl.gz openssl-spkac.1ssl.gz openssl-srp.1ssl.gz openssl-storeutl.1ssl.gz openssl-ts.1ssl.gz openssl-tsget.1ssl.gz openssl-verify.1ssl.gz openssl-version.1ssl.gz openssl-x509.1ssl.gz openssl.1ssl.gz passwd.1ssl.gz pkcs12.1ssl.gz pkcs7.1ssl.gz pkcs8.1ssl.gz pkey.1ssl.gz pkeyparam.1ssl.gz pkeyutl.1ssl.gz prime.1ssl.gz rand.1ssl.gz rehash.1ssl.gz req.1ssl.gz rsa.1ssl.gz rsautl.1ssl.gz s_client.1ssl.gz s_server.1ssl.gz s_time.1ssl.gz sess_id.1ssl.gz smime.1ssl.gz speed.1ssl.gz spkac.1ssl.gz srp.1ssl.gz storeutl.1ssl.gz ts.1ssl.gz tsget.1ssl.gz verify.1ssl.gz version.1ssl.gz x509.1ssl.gz ssl misc CA.pl tsget tsget.pl /etc/ /etc/ssl/ /usr/bin/ /usr/share/doc/packages/ /usr/share/doc/packages/openssl-1_1/ /usr/share/man/man1/ /usr/share/ /usr/share/ssl/ /usr/share/ssl/misc/ -fmessage-length=0 -grecord-gcc-switches -O2 -Wall -D_FORTIFY_SOURCE=2 -fstack-protector-strong -funwind-tables -fasynchronous-unwind-tables -fstack-clash-protection -g obs://build.suse.de/SUSE:Maintenance:32465/SUSE_SLE-15-SP4_Update/6f3266c83589823fbf41c9177b2493ac-openssl-1_1.SUSE_SLE-15-SP4_Update drpm xz 5 aarch64-suse-linux directory ASCII text BSD makefile script text with ".include", ASCII text Perl script text executable ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=5e464531b544baecc4ff266db2d996c714bd249c, for GNU/Linux 3.7.0, stripped ELF 64-bit LSB shared object, ARM aarch64, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux-aarch64.so.1, BuildID[sha1]=d27cf49cbe152d79c9352f51468949abba9b3b40, for GNU/Linux 3.7.0, stripped UTF-8 Unicode text troff or preprocessor input, ASCII text (gzip compressed data, max compression, from Unix) troff or preprocessor input, ASCII text, with very long lines (gzip compressed data, max compression, from Unix)
R R R R R R
R R R R R R R R
R R R R R
R R R R nuDs㭯s utf-8 01efda067f3ae0755fc550f1d2746ae47908608782df41a43769e0285bd91d14 ? 7zXZ
! t/ ] "k%IN66X&fV\/!'Pr-gל3Wd.CijE m w
zWA lO0-bc$kPoZ @צHШWO54i~=ddBWb4KVk# :R~T>;^ G" i
^i r, u9ƻ=U~O~nbQJol0vBlM[yxxr]YYK |} AwU[ZHJ]^nL)Tݏ&K:Kt¨~p S0#"gN?NF\6gۨof8o .^g!-D (Ú j 1Y:Y©%AyQ3 L'm6Ko[ +[R_*G JATTn*
N}Ya=?\+`P
ޱSN:]fypi)A-gUr ;Uw\ߍ!b l/MM> :'s |㞇f7,w FYL#M}dV}1 IU}̹bSX 68V,Db݃:
H~Mv(c=58Jf
c h Qsd
X"
PWdm7il>#}mZﻩeL/ݼrl 7/
g_)_ru/k9W۳TB# {O];Lb5W
%:l;O
sGi_L
M\InSp&~c|-bW66,U̒,} dA, NCW!bMI#Ĩ$'+=م].V3=9 ?>t{sU9 %s|*WG'+AS f_& Bu_l,ֽS"+**|LGՙh,#8vk:U]AV)Q[ RYqAcuV[_pEIq Xʂw44srD[ƣޟқ9/ߖPIS:5CV PV~ ?6U IA+\L9^6ԎuiN^
vD8q(cBrg~==QpAu`=k qc媲Y{BU\H)}R Ľ) /DT}J?J%5d `D>nYXD]Wp3/PMhh~s0 R8 |l9hq$kq#TP;}&I
2,ؙ}/ȋ̬Rt m_op D0xnb~k9)6DZ1iSku!KNҹ|,.B42ʓ@4dC#~W$ !Y* 1W+Gv-ќ 9a>Vݪ&Ǚ
-^A~Ds# vzAnClO1>i FswbB 0* $ mowqu[JIL٨徏fd#5$KzPXVl.Kk(EU rnʯbᜂSb3
uG-l+rZn[&+/HlM.RݕA'c &K{Ԡ6{XjE rSzޮ~] φ P֒
8=luhP>*)ODZu PLh PBaؿyW uNG$s6ԑ 8;(^˶@KG
aƖF
9 &@ )I
W}T ⛨ a] 8o 7YD
Wh+S9_gW2soA]Tp1BPol7D5B|8Vݓ0)JwL͔ V-0ޡ! ]j9 \hj9^Ό;YsQ@✒G 5;@jyv:&m;ѤCfH|&;/B/
{j-ኛ=>A; (f[9Pv+p}F~K!斺xU9Kv"3ۘwdr%$)_ȏgWEqe4&B2lZgt,0n
D
E֊ƯFTw
yc; Ldo3W HF`&Sg+r4{
]w! XV'S8JJJM ըDl_)ECH /4PЧ$W^DeZt 9##iE;hƇġ SY -.I:Bn"D=JPag6ނdF:06!m{XK0<\]+!u՚. 0[{Sbte@r? e**nUnLO#FkR[8Q\AoOAr;Eذ4B?3i<}0 e=b"- ib:YFzJ{Di=mfNj7B:Qi&ePNi+3Di[]2?&-}yLEp0 kCB̿M(5T\a\}eN_ū |.9aiy0
A˹zP&A :oVVn"+M^Ay s
ۛ ]@pvMZtڡz$(}1Rl/s,P(C*(J,'uznיUVQw' V? >eFn S490f9p
Z
kj !,r~^2gUȌ{(_FoY-F{L_0xlkcKrVN(ZX6Q;鳭 R/ogP7'6G $k=DЀKao^VI;uvN5\
pk+{>uŴ똮|8@4X(M%Cyע3LCd{m"Opr8g/V-i-:2 Sw,[[2rs4=U*rJBLf \D o\:\jHN j'w vh7Ff uhȁmjM \aI /fJDFZSN^>""(l e?j ԙq+ ,i.#M]`rpʅ~
dY+pO
WR}1$ͱKBo*2Q I(wſ4kX(i^m' !1I*6;nGghлdc~7)PV
w, `ڍO\Gd]zԪ6"B3B%d>w=- 5z
mƬ81#H[3?x.Qf$M NbuqKzi\"80kwEP"PlVMi
Ik=S)ן,Ԥ궧([/h ]RbE#_%9 uا(=sև 81?[ VGUNIhr 9 || ;C^%rEME\b"R NC5QB
7J)*xa3vm !QN'uXav]\ c]K~nd\ߗ|aOB&OAnEܝw)ǎ $ JpTq R0K. ix
J$sw*&ވ9Y)Ym{-2p*q~o8
LЀ¾+p5%}gϘ X~
┑3_>U98[ߊBUQlu 1ɣ~>X
%H3W^_NOjߑmp"r\ɍdžTn `kQ6sL#
:>2
`m@R6EmNM?$N#OZץ%I
d{ 39m %'q Ks 92бɳfJvygė= dVk*jr$2obeIVuFԟv.x/sPC
X
e\Bl$^Y-n Jn"C:I>Wjy$)ojďJ00n q.멦Qt 1]c |uMJ&< ǏxZpB4- x:Mt$В
bEָMX~s7:.N& %l5xt%vLS#IfhFd Z+9 {
^
Bh_q`+B23-v)khGs]E(g-j+Ig-CZW?c̰R+! OmA+ ݩ3D`%,کGTFi#7A> &
Wn5id>=;bFJt 5dSI]*za+_AyЇnUv5' rDɈwn$7>RoH:uB'W <obΖSss4r5>[GZ!v~8. ^vip^,)#י)fEܽKlicI yMk
&k$)FkrҞ
`EݽDߛ0&=u%8m: wÜAu]&_:kyC5~usŴm#>g 0DT.,4=;ϩ-*8'䟘5S!O⧪([=g bB)@r!DhT%:_!!wŠ[,`*7!+BٯcFJ* RuVkrPs((!l%
Ȑg bk1pVB;I ZY҆aMj .7{zu6,ny.ټ$m
m:fGt^8:u5h[=A9FF ~D* U*ZIxQߌ#a^̕ B MD 9m1h- T_lA^?JPePaLG a38?d6;͓f,<Ҕ%%\1-yAF`?!п?t1pB
5ܳI
fx8ZpӦM')Z
Fk} Mm] %B+$8Jք;R ΄pQW,G, _+}[ d[Z>C.> ^] tG٦3ݰAr%]* :9%~x,1ZV?nrfU\]s%EDtC AhP{Om0FђD4_#mCX )iϧ,^GnJpUx
rxb:D*d'B>hqVJ]46h _)A!ī # T'4K
/Ha'ਁޤw@)C\?iËRbEU)0u%x;rF ܂s$6:r9-($J%mb^DԪ4n&PxtY )dAz2G̢PHn9WvnÏyLj#
} E^p +f@oOቾ;+@ z `d2e7b2gC{V
-ՙ{D>uuM#ycLzPޛu #]%:ft'S.7 tR96ꆷ@LT,qASi6U2'z'Z 4w oqŁ&`՜uq sƫM?#{Y9fA /5 g)Q Ě{X0}
C uIʫ ;_ H-V3<+z ^_t3 l/?ߕo!Kɏ/!YD;8+3Dm9)hwD)nOrӶ!P6dvi{B'T ѕAE<,otB ^J\IixaѲIG~5]31\QziqI !:,L( 6DQ3О"åcC U᤻pn=Nle~X߃VnN۠Tl%d1͍'aG*8,i& Mъ5'Ra3`1D֙d Kn>}M?04NA37,K}wad[4Sɉ GT TCP2mW-Ui%}{ &J
½>+G+F=Xg7*Y|Z6`C^eFREs'XK&CQyQUԇ*2I 3s_EHɟOStQ 1^&e]S`KFVc02c-Yu {!E{N`I< 8oW
)쯱F[1CQ$vYfW1'%gF<^鵌#n lD֏G e
{0,$ c}N+ J& =е'W< r`YjQufmxBӤQV['wxC5$Vg SÒMTXAiNRsJR}~zJ
d cͺWx3k >K\rEE `qQ Cث:KzqG̓ i/zPv2[ɞϩJ~bŝG
rb-ڞ Sp }5q ZS-u ش
4̥sY+~ov=m9Xi^a+ Pv/=EvPbDcAlS$ *-h>6M !z qym~oʇQ+Os.RT .(nz.q
T^s Jʮyf
o
-dst)4
DuY oaIS2;#d_^oWWlșd\mt 7rNHo}LaA}]?8]r@lԙ= τ v
)rڞh(E|3ȞZg+j r.E3f!V=5.F xVir$͕S>F-<݇x. WQ(0Ӓ oΘwQAEZ̲wu41 . =Keڧ(Ys~k9# F}cpIJH=HzQl©/t 6%& kY3Z:MIF8x3K<\ѕ{%e=Df?[QTʊI<K`!ӏI8uy=(̦ ZuJm(K-ˮ)}s[$M эXe){x6yTZ ]g eҾj:+
FaL=
=Ie
zE|s |^q`864
;2"r^2 ѤA[w]H?Gru;洺{´Rp<݇ שeY2CHT 9?\O|VɈp5T ˩@K-¢XSU)?DwyK|'" .{eu yPA={AOH|Cr(j#i]i L"Q'TRqDO {k[\݂s uGg ^ޯ1vAoHc}XDבYsTvӞ&6iyO}`O[j8P} bl7{x0Ҫ(YT8i6NY~+~ w\L{ F2C̓&d 't!< uwDı,A QX:}C$nL/"hY.U&.#)4yީ[d]82흠?56 ="59AŅ OG#{-Nh̉2F6-9qژ=h 7d˯K=O@"_HjIfh6rxDC K-'܌bOPs.6,C"FDy"⫥^ֽE&r Sq Yj 2O< XexR`Pd<8X$# FkLs]wi\Hy@_;y=& a B>
cI$:nݻ>
;9f"ݼ ]x肣G7Z{) b ǘSa}]1 WU7 j02!xu?a `EZ ҘNt$ Q 0NvU~Q peהCpNG"Z>Jz ?0
ˌvZ=aAjz5^>Aԭl,ЯǏ@%vLo7q w;E!C'r\M1Y]YY_wՈ2ZGqJ^I,7}|B)HwSACqG*0-_ObK-ZElUCWq̗m n}BAkfFC " @v+K"&bߚS.!WS%x )Ƿ7 pnY]2rX
@bVDs7(G5R}]36˘;:̔ WT #=YI$j ӁFLGhHa!l_ &4BԘ;"x&,fnqD;+:PЪoEń Z eR~ &;_)f>0Tw$P iqێhIv_LJ Օ 8SZzvJUDp _>}0b|w8EP4)K4H mFb+t=}
ja0'>u vS ;яeM@"N0 "r#BEXDArTws7DgJ(|\YUZ"Y\vDe~Df
q'~ >Cjv[ΘڔW
1&$7DQFC!!tCr晙6#ׂ{+U]Y" [s^<rzr―;nf64Z!&h]ӂIժ[UQ0+LS7P# bmqi
[̜U/W MKaeb~+kms+vv#RKH4Sg! Z
G1T2v؎mn p{7+WQݳ mϬ`8sT"Nڴ
K YB :nA)#㖧JP4 s.e da2ڟ -$e{^fS^[K+`ؙq=<.`͍<+ U2:3PrgʞwÀXt=owbjo<Nia5Ga(V$XjbPv#LK ~η|Vԧ
`
́P:rjw4W z"={?la!37埙 2r$Jcuqh ˪PĆt ̐kqIr` '$z҇;37>sF7 -V@x: h;5mDgw 幀E$ajuo>w1LJ5_)P~t霁| CY'GAg;و DiSAxڜ O%pts }۰u]u ۓJZߺ٦8Ak`BnơayTHӡ2(3PrTW'*0TkZZ..0huS1";ߗU*NZ$0` 9HFD>=aR
T,bO KxNmLq/TGpBiqN>0| BUnX!Ʌ#%YȰ
?H x
RI?Lr|f;G~" )vW@Ԇ/z _ Qɼ9>|T).N*0H' 8+ {}$>aCƐJOh^j "LB [%{H?-|;jjW`fqGWRۡZ`uCGU+9 N X9`5U% ˤ|vWE6^)WcWOߏJwzM@j͢{/DU#նt+:BJI·M ]ؑhxҥ80eHY\ '4OwEE_3( LPϫw8 u' cY~K^~3A7ٖʣ)*Y1^~Bwhf~H%!_BGfPbTl(|Glct
xGJ{[{0d*W'y\LweCf]""@?x- 0v~4(RC'ަ0Q8iwS7$qGq 6X{ !'4~c
V8ĪL!Q@C՛"ZM#
F3: C';mCf:lyJŭHD,=J יuM' $c~`PMzg'~}F
VJz!&- _ݩl >y,S~6E\1%xŮ}Աl{ @{ڕIBJ;( V PRޔ `7b# &
S e$87S agd=gm_D.՝
yMЁkq#ُ:A8&LV#
r %I. {^}+9%s~ԛuoo\Sؾ@iL~Kn G)Z ̓쓪?֊<֯h L"1F~d3[y@,Cuu 70fݠs[SMzZ(lhf"hذ>gVW $W;[5`wjY n@`ۦc6u֣x @-g= ,A3:MQ Je<~Zˮ[/ٓUvl'>aId N沫x÷ ಾ !ķh@֨ v߮2AD)fEo7Ţ'T`W9bX<9{!&1.VXAtЇJ]@
r|MvP gd9'g+DӬ2 7Ox9MvX/z!5HorK# YbrCp=n`ڊcݻ9elI%X=QJg/n
P8LlR
n-9"Л%ƶ
@Hl m2gwA֪[2"FOp˽X
`7LOG)\"7ةa3~/{'[0ȓ3H AY7ꦠ-x((t8µNmwb痘)knC OL*8r 芩"\$5
h|`^ *=`P3 b#;a߈L<3X*46xLss:u. G>`h4jD :l?/iK\ɓ/Ens3x#2u`qm1,Κ ,| !-~_ 3 oyeact CgS%%.Fm5Z3d ]y<詏 7۟P;9kfp',v BM )Iْ̡7?+Xڐv2'E'jU "j?=-̲`Pl'\ L ]єZ{4j\B
٥`}1Oٹ I6CvC> 2 !_#JߧDeS vZĒ0 I^䎜C.RՎUxUI Ԙ?n.}QQ+RCtgu.LSVwPpx4OowvqhX@bJV SWt#M/E #uYRG|r5L?aWnc dz^cq7?bHd"a3w`Jzi<;H6<NJnji!(θtc[ ߵxOG/$-xkvViQm^QG)B/ds ~DK\BQç_
5{{C.+ M.(1 mt-h1 S' {$>z1G@Ԇٶa5}a_l;~ ƭ*ɟ/ rLOӸ.+l iLJn#6qave["սPm2̼
Eagjtpm^:PNSjԓ6,no!v xSXc8AuH wwR >73 AFlNw %XS Sۧp67lb!c+"}wM&t_AjecozP]-v=- 2/ZGnjgRX2)Qx_އ."8ht6fcw
<9 3¶) WHz=DBn] e|R@u6!9A_qZPF N'AaQ2~@O!ah^A"mw6:4aj 2FBڞ(K`j? _m 2Pۜ7
(r$Hp1RV1+%Ɣ?/pH 6AOe s5j4)M]Y[سrj;WeY"!%>
9z Yʤ3"Xʠ;JH mN=8
Ovgq[ܡ 'Rڞ
<)l߀KpT_|移 u )|@l?L֢ gsQf
k?]_RRW3&b.[/ŎL+ݶ kSŴto\jCM7DKw^92i3#+z}Z mI# XOt:LFGm<%܍gг-#@UٱŎO76*HᗟnW(0v$ N=} Uqcl87rAcS9D+&B)7d$°u7*kG9
źP L2
{ӻC%0XD.G 馋]$>%ute O)"M2=Ԉ w,1A}՜%"+X
Úl@Ys GOrA9W Zl/ٗ7V0*,Rt_u{-ҎQ >P0_U7EVlqNf"T=U>v(+%@ GI .}sXk̿́4W
CVR"=3#->p#`C eWfrwE[zڠq
].OH'"B*aC xW+ u+] G9L%:Jx=X= gQ S sWGu?p,"-Nte
Ke&c*4y C *
Cs# X EF2eS`I /U;ozWvmQlFl[6 J <칝}@*z^ ^wE w8 cgЕ:JTٖ1t+k!x5A|SDd̏%ɆF M|7,ف دVحM#Lfx t)_;0'Hn
X }щ
f9RgXݜ ! 6UEjK,OS gE vtq{#K_6,0AhftuQi;H]-wٯ'>) @|^u+X0U*ā.6b%>5⥒\-4)Fp4Bj1H@( S
. _LѠ1itu./ef},LF^S^wi1> }`8 ±WiRazjS8_. (Ssآ*+yZ[-FLALPF_q|Q!_я4jT- //=LT&'.)>`xDa;Fi- ~Ph_>ӗC3黅. +_ڼfp}H7 2%wؽv 3^6"Xie<;=eE MKrxvQ_/>; w 6)CTl
J{qqE]RT@"I5&@%; Ib.Q7 ^i2g #*''aFOθ+T_o1y[EZ[ b;[@lNi[aC"mԄؔbBQ?OhpժB0sКqNEh^sUi'Es칌M-ULOOwoiNa"TTk$-7ѳH``USnh#ooyt5Aq#-RB/b=ޞ i>{3Pm5C8q_) @
5jJ(i""$^D21 Xg"
c"ȭ昿>/ 4 { -_ѹ;'ć3ߙ \>i na 2zSNN@}ڏkjȀWw-(C(7َ*z7R.qֿT4a]nn:qg`1݅&#^ i Bߦ+%a QcS+`4B"!OWFG/Y0S2*0ޡ9r3ƞx
ލ^Nv,(N2 A{OQ7t輢1*jA_Zu0{6i $ ƅ ^P_5so#Aw&Z ~%˨-riN&@B iqd/iVnTs~@~"#l :6x > % :V !E1r@=B?|_j*8gm%*`n%>?M_5VZ"i NǕIL\X|{MW
k>jBb>NeAFSp$|2o9Ty>|FobI VޫbYqlM+ y?zi4AZrH O9~ 'wiGrzbxCPb49"v?
e Yrh,%QJy'cqv^b36ƺy᫄"/H.߹=U!7ҋЪ^*'0;M5C\^(y'V
x ~T] -( W]i*tDsH\V- ՚U4 RKӴǟ
>ڍ L,:2gʱZTmZX0^ϳAy\)]ষ;cQE3Yk*g/mg57 m熼6,fv=˻
{۬>Δ:
* MUkeq9oXyg, 6V ུPL@(*.&grfƼ0%;\+
_'
V=?!<1cO OtӰOQI SNێsJ%K.zFiX.ad5(u87ޅB1J}^ Zv%Zc۾ok*$] ;0
{ LJՆv@D&r)eg7b!u?.c qa
<<xӼ
sTQ2 g%dXkJڥ4'Ҿxhn3ЩCy1T:=WO N?" ;jueHHc$7( hC&?N1P]ARALˎ RL P2hA:U(N<¸wo2 w7BI+>$kH\>3i6R;2$
> qx :c&7\rw*! |RmRfIg",`X)B^6=[0:$XM*eC "l"sL0@ * f~C(`pr$>T'G"=Yti+?
FXC<~Af 1}7LO9BO:ۙbF+)o|W n0tͳVX@&/N{Vѧ8B> SSs ? h&Sb1wŵUVJHP E1HѦuTYBF]Et`t¬hZ0®|D5,S:o !aÁoeSvr
j:!zgJexfTT/J
(QHYt#O l,
얠й1ln G =:kLomTNeUjG}~^#@`aO0IC:
K4|ҾO-@!4MGR1 nߔael?Qp?(4|^bLb9~lX.@3rzo ~y 6 ؛#PylPN&R¦j˱9&8 ;ͨ->@z'}weBmM1}DW<%xDcaO
eL
j=Tbq2 x
g"gvY܁!4 HqQμ7 us_OgHI^I;M*A]j{1
.!.(uv:oD="^;,??S|ne$) {+ava9ֈEm~5Ƀi4(*brGzX*i'Ǧw6 H ewU1#M> N/+?ū% ;"ԍSw
l;/T
)w\"d˭ќ^>P.B}lѮ] 騘5:SO3)|vwmMqhIiUYsI:_v{*%=ﴁOfUi<PR#V37eW8o3F%ʈ[ Z\[2(;A'Ҏm~pξb%IzlZdU0a{Y9R.ݵ ^ 7B 6~Џxe
aV>w晫PSDVֳ>́ZiX?KUz j2fa5Xx> |@:KQڨrg(zqQ,n#=xA֮Rs4 \ A
̽t'`&pX% Cb5 hg23+uxu# hg1 8E!+aCum~(h/QU溽MޤCME<3[b
bBN4s5 lJAxj
֪k\vx@vişH)].veN里R
he\'W`@q4mi0WAjsJlq 0ϯf)/QYL1F}Qlc.pQJ%e&lw\]lxQom8%8/>@Txkq~:[M:Y9E͎E(Ф [ # =E(驯6U.q\~+\ck+m(n7HwpYNjPĢI) L]@9|b]Mv-@~/Q qp @!H4*e9)?̑4 1 nYdm@i^ر!n- %u ЉlTQE66EO $Ʊv ?Ҳp&
_;k) _s3~ !2.s 3ut<| ]
_ԃ9&P fds`P^ϲ]aQlta6
t*lACđ:{ޢs0V|8t
E ޝ"LiJ~)+!~ 7~˂=qdA7_ʳ`Q?c:hHAZ,ִtl15Wo;+e Be%5 {K?u-~W%OlIJ^́?ٶ]//xͩ܉Õۏ
,N`l2U*\
Rz0egL!TrȉG2(xB({uVYuu$ MnmPϙ| }?F[H ɠkH^]0ni{.usc5 b9|[jjJ/7 +vOg1}&3 *ߠ.9 #;8.Jt14LnwgSZk 4LFQG;^:!L̵.go|*n 0 (lT pEx[@d'LHIB?WPʣ9Sy F;p1c9TQUMx [x xNȱlm#$`o,`s!kn=o;@Q##, uieYxxHJ
c(̹-/5\|\$%Vu$7yluMKZغKC|[ \KGM%y7My# Z ya7Ҫ~͓?ZB #@|q}4g{r A{#P`,#ץySKbמy]!0H dҙɗ
hb7MyZo=]9.~Ɣ EiYJ"<`FzZ)O s)H}a_9
:wWg?nPmu(~ EMIT;ɑk;##z@ԅMXV[GP#
Hzf.@HfrHMG(C}J Oi?eQsbu(h [%ɮ@W[!.fl(2JМaJvV(sȻjТd%tDX mV Zy
PmV !uׁj'>ضgMN6Mȧ^ţYĖ ͡Rݘ۟bmyMKxU+ȑ(OXېlК>E'>%9)LдSuYj݀IHNsC}w8REE-7~ 3/t XMMqj=֓ŸVnP
]Bi /(9dF})^IP7|{#qqb$05)XݰMęUʣlt~Kˉ(?B| >q8yZJBP(tяSpp J8{iz6q()Hçq(SG qrQcINYG
d.JꀎS
^_$V h6)H ,6}
+"C߄#˭%3śP;=4o/gvY}5l̄'eEmF%VsH! Ч}JM&8!yTPr.P?' E;I3>u]nAv@8 e P5: ^k;4gj2(X*]G\fX c$`;y ?m mv% ~l }[nt5 @è@y
uΈ(U?0[H_W0-9nho]QBMxN>g3}'&J:Pb $J\Dm橚!GVO#F؍=VOU͗>ӓ}b NjXT%j?OE ?H0aN-^FiTU}ro+]y8V){ICj_ei'l83"
XDqҠ63w[>(=u sغPJMa/#[@W 0ef1ld:_#OLABO9RT:B >.Cu *]^B^LjO
ʝ߁̶13ή }E< qL#f;y!i 0dwUƍx0u*x`45UQ{zi]K?Ȏ)M[l N"t@ Io7o6#
&gɾ t?~'f_(8<q
'_ M(O
RJ6,hKR^UgS+uFcÅ/鰧 /^,r^z
Tw]X
drA ?j$ )6_w7 s=W dq.ޔ{;1
_oH?*r7) 8h*_kݢܡ'&V) 5%^ByK"&1֕h˟pD˥/? @*oDϡ|)2JY> C<^-5LY_Ku:F:X
4Č)فTM긲T#?%;8 `?d7h 6l {lPC^YҊlXI c`ɒ;X
%MEFǹ>^;@]#?`TicfJF蝮Y4dqm/1>H -zS C@Q鐌AU ^!6 mvS fیTMSH-dc7jQ3x|*Nm 3dgw\~DMXMRU 0Bv?so--ʟ z\ H IkY,4lE358F4ܩ0l3 TӇU 6n!4ػ+՝ >Uv C|9 t83Ti][g9w_f¡hfsq=BBb
*OT 4l & ߙ2Wmq+:7J6 (#2
ۀ fV,9|m UnnJTx 2ϞOXWn P$~Tcרoɽ%Z]' X
{ 1_ͼiЧ;U6:2~q<,zDp hBby.c2 SW79줣$ "8ʆӧ?j& vMͽraj Ɨ:WFOG[JTGRn<^Mkǡi'; "{@L)ś%(`] תqqCO/6<-$i;j绰"'GqUDKgF 3j킥qX>1_OXjù _сBP&}*SX#}3q"9V'Yq';vК F͢R jH^LrvO٥ ϶1`/b
;s3K*pqkS*SiwI%;)c:w ]Fc<Ҟ ]BHM0C*}8]pcG\E4/j$G`Z :}J:/f>}fh?2+[<9ިwZ^. s>! 3wI#]dEUZ8ڪP ^`:L#NWOCcSb.ڔAsfqFӂ"ID|L36+5pn@c!v70p>3_֨,&UՆZCIi wc)C~m ks.8 .FT QK
(8ol<} Vqw#&KbxuGYżok1_;#j!] u$h*a?oM0Ƈ. (T.Nնqɽ?¹'x#}pIfc+MwP(Nb Y#j8i!$$!M-yb}
z
ٳ=f7|{fd/ۈ(=w5 ." |0X6Z\Rfkӛ\Yާp*YSńB&;q7y A
Gi:A~_d
VYJ ڴA%xlN%Wx g
SM hír
?uR?PU9 18#j|+z{0#QUE6l}17[\>WW9s]H4G!=l/{@qXRT%K@O)ZQcn5 2|SQLC/o)dntӯ`ߴρy.z/r֡|x-ɍAj9k@ʆSZ:j)jIû40+&(|GR! c>r;>I- ^8G ӪYe'YO㟵N *ɉXn y~_EZa={Y|N28PXvD3>\[/9V4P ma6" Z%^`jlbm!͞n+pg~ߴ~=*R.4hR-F4f!~/x&zԬ!
*?Ԝ:\lr@M:*h5_"cPP0>5'Eb46,B9Y[2 //LJj=T #) 3^;8 )P9DA/7:J'u'kM<:#jQgkUמYd(\ԍp1"'Zd ?{pSBLO@4cy: XN ԢP/K~bX#P}_7(R:E.>R .*iϚ_?T`݆! y|Ȩ:S8&4dQ-I0H ]$Ky~4oP ̿FVS^gLzr9Ȋa!Gf4M#F-x
aXz/N*u':,RN{ Xh5 8?[dyۤT3@1BZ{7,oBN'Q'7jԫWb1V2Pc"˗o͌O8hƭ\ xrst2K)ǭ@8+>
hhQ^z4
>2"yȹ._wf:( 2<8_Ñi ;$ʝXI 1fS3]LViTTYuý~^oN-JX; fj]7 yGVnz1>Xl&%_{_rpS
kOτ>}FvZ[Ql?2~MwEVrxԓ7 lO mf UYٱ
i`p%HnC/@ox4 D* C3a۫=4Lax˂
_S^EJIhSXl_iv1I] =b60w6BG< ykmaAAUm lGF OQ4<:Ǜ}7 Y(}TU}
\J"?W
`6fpG
Q|E]A@^J5\V#pn>즂-VY z
)ߠ#X.䋊S0XldF& NXu{.Ǩ9s7__-nElU$d1+CCxl~24w},DĢ3x~E?(ܭ{ _2b
3V lsvgIS=ܚĎ0äY -Iw=z|fdx{(1CXNo~d" nٷ)߿%//$P)Q[ C12|Hym*tym dz#y |G-M'cV?c)`UVwwܙC
鯛72Kcn=qy/Mec%) Җ NxfjGG42ew+CKҡ8IѠ.[KvxE;;:XgJx:MW!ώuh<
U`+ o2xp6xtH@spL!V^2! R+ U\VV[m
ݘ [xucYV;
X8^M&)Ƭx꤂?A,V;> ,QJ{vdiA$1ˌ3Mb Y0WQ/1Wd^[y r_FԊ<跏 @ ә j*Wr&HcS qQ*{"=6f8}
#B)(BRH0~* 6Ke>7VKl3j~IfrT
[Az.1w%#w6\"X,]q ݼ1p mLW.5w3MtE}V!Ry6+b,n, j!NTq3%G= iHP⓿c[) $dX} s%8JeHl$?.g$4Y xtix:wӹRY"xw4}ͮ pq3$pj*i:G Gcv4/'XF^f Xd#CK`5P!H9>N#|xrFmZXbь5'2GǴ8 SNo3ıaq&q5Ɛ ߞm;R}iX>@)ap:
5Os\=R,XƆ$$B R> ٮL7`
3(F)r*h᪶RP:I`a
;En=1HB \
#ѐ#p nX@ |+z PD +0 X *0k*TQ4ȞrD6>Dc 0dh?\7Ed(wƑE+c8 rG;WBH 5QHŕ9Kc1[B9f5^ $-n0PHGbK7op`\jR;.bXr}L{9`F/!3BU)?FwBglϒ!e XDz. /xoPn/sGK gjYd/\2Cؘ(M({"E~cgw|&gra %ቻDL5 7ҙdJ4I0 wTP]?8!:C?|rKt$).-(Uv"ax#5Nr7[Q[)E 1((B
v: LF6%{Lx`ʄȃL70@6Ҭ8oXOz "Jp`0eƶ=9jIA|.I"HAzw^B!Qh=5{r\'mm>0)q'P b;I3g}
5>'[ OͩJye,u D
mB.P_^R.KE|i#3AVޭ &_Ӌt?1Q6p&0o0bbTy {;[?tJj^s*Ix-֮BlH
J<~-
lh\Pp. R7˚Dby[ԟ/ϨR,7/ p%
j7ʭ)6XG#Í\=N@ѲvcI[ Vd=\*DpQod} i^p2-O t2pA,MےX8m;@EnMj|A}Chx_MEM}Ꮳj4WUm 飡( [he@.YX\lҕĸ}OW(Rٿa_gT0'8+z2;@jc,#5@.3ǨYP9 %-LYMzR 7 .Y ťq
T%e?"F&iNV| ͳ `:\EuW*4Sk6>g* W1LnK Gm({E4 -} Y~;]Y.g3y#gLUY"n0m^m|ԁnv/D:לvCKWb8Md9SZyz YgW BS|n qKZf^j94H͏/$vBOA/{6H^7wP"Ū!'8m {<|V_Mn@>}Hh[i.I]%e4 ^Џca@}QrNIg*8f; hG"
-%NH*oM&~i}pNz͈nsL3:|@?CH/hv:b2s66D#-xllpPuS3 ; `y1y(6*L|=r*/I8JnVvyn> \e͞ 2_f Q/?˓HĚB?djS++E7/8[AR|\yᯱ%iUjG \:O!+%H.%;spj
cNaр(x
dž2Vr2S{&
'Ri[K dW/C<N=ʙMeX"oRpbSpbkU I[f̈,|tAa .ʶQ '0*iܖkk߮AM|()>(bSEU;v:G=ιg .UԱh
Ub
^[ygs&ߧAO9a
\i6)8}Ρuj@%wדQ<S^0C \]ՎBa!bv >< QFgÐFv\*1gE=;>Xu4#nGRA0tQS pLP@EX3NyLn7wDqh4QZM$he1{8? } &4ls`JZbP:H{snȹl
OqQCȝGL$Il5K2:>fJYi`ePZ$8hDdQf,7U)z
Q)P6ߍt q\}__1#̰b?7,f$O)js kgJխrMIib[==Vh7.|YTM#AȌˋS
Z qkh\cU.D#sxq%UlZɘgY Է*[ BzD)E{)F% .E!t3+ߺ $UX )8z%wYcE.cmDuufUGMM~c1S.w"I!n{6"Zڭѥj lh< @UE
M FlmDj_Ĝ]%!bM wIP"?E
ORb=j^
LRCD%k?J ` Л]yf ص9םooj&mu!'PF+1?\BS{23Z "6 vvB?</'j ]SP -eًȉg5>+խ\]j8v.
LvRRtZ/d_ .:xw | IiHj_'_g .UQW @b-+L -.7 rJoѯ$e!CSf^E|DE,ru~
|Ki.uPGˣ(gD;0vΖ6V)Jsy }wi 3*@$(W (`-1E B c[r
s i7.3x(G A&Aު=И tV1C'"TΉ[?"ոfByi7,Y:6~. L?_"!']GȄש䬑쾍wӪ=+ h$ HUvA>7MT[>ˬ< Y pT8J-G=;c l4Z]^K FjH?~,/R)(4Fߧn)4iWB`6ڲWSV_"5Eq2k~ =37 ^ #>$<|!XV?)ȢP?pFHUmbf_) N:u#asO.Hy 0X`al# pz# :XߎM0!Je8:hRK% ڈxib'U-l} ] {25H{g_/28Q9aE7o/ 4+WIt>sSnWPt]E7x|K}7x!@paRcy݄Йi yVP"ov^#Si, s &OWZIО$ZOs2q_V;6%M Ҳez3!\Rl U
$8> ?N=|_Bng(
YRb,͔+v_>vK>|CGjn:5 ]O4Nnd2=e[ [&]_SvXr::?UV{T]? 9&C# e\OG
Zi$a(Bx<<1P"T;#)S|cyv
/=oܖGL:FHERt"L})݀Bt]O7 x ٭?|Z"Aj]F]VUfu33.JF KjSJv!^!*o&ډ_ qbE1\QAdp5Fظ$ o3-ض/\w#u0Jl- *gI ]CQP4Qk}.ZQDk,W=G*تt;'\Vѡ=,Lj )d̓g~U(6mex( {WR+`8rg7pm(v
[ Vb:bCOJIsI_Qg. TNG([{@!N@b9{1w_=' ZRQٴ y y-]8HuIʹ¡, sdg-EŎenE.ücqq 3>ePMjɠ @tM!a
[Kj8x(cI&pl 4]| @kb$K6UTCn6xթ?G] TqJh1n6 G'qm(-b@Cl5}<I@iw&R9HMgt;?ќQ˧ޫw+yka?i *Zπ\.s_S5 }lܴ@Ie9uNtxs#TEW4θȴ3H. ]W
w(/ $\4ֹkst$;Y(ՑݕWZ][I&5{GfAI
\!#~XH[["i5:& fxXEXEX &׆A`; :p >=pzgN#6B[;5WR{(#$M 䫗Xx%xv ]t3C\aI|M\ÂJ{;1-)di #
~:'6_uV?C8T閴YX#"~Cf?J9!F3iu/Ѓ|T9*"T%`)2ץ;Y5+= =
\5HVy5n>Ҁ, k+jPy?W'?x
~|R hoc S*)_砻}WW|A3) xSK#0L-nO-eJfT&4w}^Pč^oˮx+%VuGi*7DO9fCCz9 kr׃I-^[CPk6D~gD'8$?(EwչX`\1rp&X xQ>b+Io f>>NgRȞΘߞW&Ɯͮ ghoch',p fbȀ) > w;-[[]\j!ܓ; $ـI7#l0SR3h/|u "xԘĂX "9uA k״ <bb>HV`_5?C i1x#74y֗9|zW6MxfF
ȃ{h@c8GAZPrq=."3 5tGnձ#gL]
w;GЏ.]}(*{^H
AMk"lnI8~4D(%xTi)Dʈ?<@9+8#<0n]S=;nieQU
B` JAڸ]=X58B-\5aǟO;3&?;QpC i Vo
{uL "
S1q@CErzuC/#ivV/A>@<瘦)4M[Ҷ*coWIE菮]-mC 1EȿEx)Rg`#^@";dX+ 2k ebĻK(YrN%1h3{1jemn n]ӷLJ{ m?ϲj w$ٓ@;ܱQmFP侇0B{]욭,
Sk7c/ܹ+0CDPɷsl W^
'⼃ ʧ(U+2ߊ8)__M~~۹M\XE%y5|'1Q[VsuudgsB111P+˴QlfS e)gc'hF-9ShAo
u|> Y;Y4&bs7H
5eIv2t=7*9n{w|hSs 4/ - k/ )f[z"Jzq$MNΧ\֧kO}J0(xҗy(N$op}qi8^ HLEO1ʾPғ2{);uMHjlAOgjf;Qy:\ ,鳹&,# @&wv%3) ?xƷ}z'B@`O,Z˴ Y~
8g 9{_tFzACaOn %éJW
G sLaVAejed
I:t6 `v P:Bls U(pFSwG Lc Xb&V達NJy˹K
<7# W8%"151!'eǷrs
f {6G= SSxбƬ}M8뭞/u^}0 /JS]Z%¢ذdA:B,.fy{$M^H9Rb T6n !p#\ 8k#NrC: /DL'2>
CѨ,%m p_8,ujC
_۔ff H G3Ay-$6byܡugK,`c#~0""kԕ<_[w
N17^ 2EE CE=_ފgj"05h G{.a;!E_cUCRTsӺiPHei]\s o
~867[N738QL#F߲_@@WA'[ rD=#$ewJIͲwYwСҌl L|Z>NΛ!9SUb%TˆMA;}c5Jv
r=2N{3BTpSs,۾ nSi 1^ bW$Sc"< -R>W㭛 F?NgBE052T{VKoC f獗M }-~d_&++r);fnMqZdPtυ`h>-|ٗV]eG>Nnq. 9}Ē ܙu?r_8*;EqTnj-|-*S!;jcVZa)ueJU;#Mpf_PnAXG=+zeTb-R+Eh)!O΅Wf
͋fHR2v鸪t ߃1Y\tT5>Jl)!(;]-$0e1jyL-ER N
;Ok"Q $qwŏ; 䉆 B8H<95 éjȜs^Q쑬&Z 8]H:WؐKBfݐXQ嬃}ؠƯq?3؋SKS]Gm"[^
s\ ŋF]2a U;ui~ ^M~m#.I+d}/fh|
r-3RC}up0bw>PFFf܀ϊD g9q]YYǿ;$3
.UoH5n]@հ+QAܐ|zh=,mALv V13kcRiyV!* H
'ݗ60&#e@?˞-kCLV2o" YkTuiiW6/Or0VFws^ޘg7Q ,IH=/^ f%̞NαtNJGL^uYlÊ/^M^zO
mRHaTɐ =$`x'U?i :sEҮxv49 {)MJ*OYHJyS?ͨA'ZEۻR[-Ko vfCu %/B (u&g?U *W|m &f1A(d/^kV!-q
{G8G#3B+ 4{V(94Si!Rj8ϐg > h\{ QLDo"10?=gEl< ]
ѳ(G =ſ b~WSKem|ѿfR1[TvzK
Y z)*, |{ּa`
'mWQ '6pB tF5 F-bSy@%@qtyCVl"J-/Sy.EQpB g_TE Di?h[N;~
WtW !
09Q,/-< g X ?mz6'DB=bc-b]^״?'T5u>-Ȱ T=?@(Rb |ؕ_ c+gX=H+AjuN8C,#g m)3'H~cbئtLʚhVI켩m+S
> S~o!TIn}bS Lhϡ-H4
Pz#A RyvKj,cV%̲,Pk
*`x|W\gJ`u^c$ꅱRsѿ>lFND%Nq%XqBy0-=9dkBy'fdXvAOc姄[HB>ga!5 Yy{҅j׀ WoC&.eC+?أ=ݨ%\ؔH
ܕWq[dM9/~jqg,=l)ͱO`{2+_Dy,A㩨֪ޜ{Fh_^%EƦ;$|~dzf6L fB̧?-#
0Kࣛ[)o3N8~ +"I2=k-^u ]2
5oXm2\"_ n1QBeǛz^19&(L`uB}H5;3Mo\c @MQ*r 8MoRKdV}/ށoҎzU]4i2㛹XXW7l?j o <? ^tц)OB7b!ךR3 0b s" ~$ ATUFQSprIY'"_I>rҧ.Znk vEW 6y OHg@ nn8x ΈH(w]pBZ)PtvOt Yl@3T+H*; -1Y mXZS1vt&:ƨrd6JɱW>DHSZ1r
?9Gj'"#R%7ϖax\Af*ܟCHF+įkUomcS dLNP{jN.4-Gr$MK>ԏI.#s!xխLBe*443_N$ E24EAΈR8G3Wfv4T@W=2zq.Ym,}b ,Er9! CJn_B 6ы Nj<n.} %\܇ T:WPR-5E! g:@Z9[bhyViz7H{8B+<5}9g:o i:iݘwKA^%=6(Wl| UL< ֣y-" 僌0@SWxGnW &ebB1|6TB훰 ).p\=EHhZ P w1A| 买
-(fEI b^d IX\djD
$jn\DB滈_ī(l\\7Ͻ8d)m|`HDF%GٔOFR! SIS()
$زF7bNQkqOEhh~3:l729f݊Eٻ5W݄'up/) !j\>4u½DlLs=@G%@4Hr(/ܬeF^K /MNqE p/+87}߮oi'0)HA
z|-ê "kӂ>vMUhob_bZz@^כZQn5{n9>lYdm_5B8-ܡ$j;y_ra4[S{??[ PsFQ^eР\p
=2t"ҺP},R 3[ Ћ8#ڡYUp,V\g~)s(N
4q"aCZ8JF#̐/a+i-NJ겱kإC-tZXG02T4Q3_0 Ez9GB |/iswpg^˔[#z` F
g)ku=
d#g*б4I/!('hMzЇUlտaģ6Y; Jd0\vgܔ䟤 :_O⹋ FqҮ1~sJ `bQZM?"-w%;;ϑB֕Xf YWe R>Ca$2],VZ!z%9i 7Mia)[q/S"\yG5Pe
,'4mTxO: n
9flHc4ȍǭ̥innm>odLG%BŲƻ+dI ](A@Bq
^d ^1sHY$0pU2hٿt'H7b/5
a P˫~enD5 7uxUAѬ ,"\Gb#y< Б&+.|J@M)m":|/rHm {DrߪpsjsCE )l +fZ"M9ײta= k!PaOSY=ꙟ,8x=2r0@:pN#6 hogiRN*cj`v : zP] L|N p_3 @I T*{8OǣG>=^ak1&w)3`o4c
գq'18; OuM0kC06+t
ͧ$z':pDO3AI*y2۩EPQ8dM H">,u;F 9 7ϫd;OZďw;Ġ O=b}WIN:Gd?;E' @hr{kE _G>Fm~/&4'T$=YLx(ow SXXPhwycgyyM>*ԔF0V6,$7:d@=`hy*ɱ#gTge/2Ql x4{uL;3 G%;mQd";)T(k˫㋠S(xg]տ'Tk@!f<_pIY8yo
nM@[}ȂHi|/ۺ09i^÷2p }+YZS |D;}2%i8x;2JB֓ߘ\ ,Gxy{Ws*YFzIΥェs@. NH ,)I@ tqYMqϫ@>@7> ]^齴[ߺů{G
Nڒ |JS{ZD״gf(dcq$ ;LX~fQǰ(5Iii"<5<4t4d>Lo}|y4.iTD[ݿx ؛{%\._ cI*X]˷(=?Ԫ8^~- \fh x)5iD 6
m ם88Ɠ6&8辢c$Pe}OC"|$ qDLLt)@
KتkCDÚڋCj$;y~ܬxA~%ծ@#hqd, rU- eV,kV}iPGC;0)!+5K7?NQ?V∩Wse_-)
)LtpBWEzZ g-ZܕGaS,8t7
5e5('$D[ \%|6
;> =;@߷lWO`ֈ~s3PyWy@(YYpCьYF-3s Yˤ;MRQ ay̱l?P $=QPf7Xn1p[+Pcs]kL,!}o(È,# #_8pȰG{ċKMP@\x %8G1eN[@;Ss)d`]+FcUdb#!*}TUZƞQ(; 4Ep(]KG4 +zނ`2eE(Cg:<D{J%H $a&O"lﮘ
֣sQI, B #ft5$ZͿf!%B&S *-ɟ16TIz|c#u Rr?Xs).zZujđOX@jə]c}|xߌs'wpU IU7Gt߾$HXy2*jS{yU#ma"b .IAvX]y#)4\a. ԕdqO ssH\ 5ڝL~g0q'7ob/FBrM@.if%S DSN ɸΧbVq, .jv
ĨM:o۹5=AZf˙KQ] Q.S$@jld^즚-7) Z
HG.ֻI( h>"+r ^b]Ϲ.T[a'o
R%2ś~r+%o\-j̞꺪?Q_zܲ>|w͇k+D R3DNeF;VK\'l i HכД--, 7q8/"z/e&KaIvr+jނ)p/i *t1;^D @R4s:,3̍pxf:=KO~DN9!7/| rm}WjϬiW},SqTg0a );`F.Hzv[xvc%$ʴ^YztJrPLrHY?&n`uF$(W 4[ Fͥ @` ,9uXÝxKCMsѹ1 tTJjŀ@%\nd#=Io1 ZFU ܀[V UHkj6 ֗Z&̰t-dāQ*bdq\beYJ b3$YXgN'`s;r\]t,fu ji-Nds~ /8XUt1SD_5Aptx|` ? `5oX<'P0dg3 4 +DR|&x(^L
:Z:Sg7C:\>URk*RSD[!Eg{E+4}` z
v ͓" L\>yhX"ŊM8 -P,E@
ΨsNE1Z cAgevS 4ûpoLYQBxQR\T#
`)^34Q!z|I~w21`99Pn6XaY ,ĩBDl8ķtԽ{/Zm4
ڤ`A}}1(@wզYc") 8/JE O Sy-,شwWlU5F#hXN$ȈWnz!|*nf`>N)F >KS&;lL+;1z ri½Gy0y=7E@BHZ
7(3v;m6]ƵL C? X#|KȂbqx[ ,)I2U&ojm#Nb,Hxe4ZrRCYFh
oU7zʺr*:ç.fsL!61[ܱ 2~Ztf1o]s|!o>B2m;>hk^ͨ3@W90g< 2ߛ7,R O`$}/ }z ]}jd Y#e>M&;%#up[ * x̗H]3R_t@l'oi A{_<6UBO0
'%K̓:/ 6W IG?/XX^:LB4yBOz2[d@1I,_E
oKw =zV2I5؆UEGm>]Vk?qMU+"Y <|12dwF n9C#Dc MXp|C/)[gmd!]2
H,&zvQ7UGiԂҨa.i1TQ~;q_om)xxG ZvQß?ߒ\^3$; qO$tb^uޠo2~:$
1 /ڧT}{L1p/hxETXS C3a.ٓ6Uɓ o#Vܷn91WHeGz%/ ж1{
1m&%YGaRҔ Y_n(;&{y@ pdI'ŌoV)K]YQ`&19K ;QY:-go6ݭ+xI`>ujTꞭ,W\& !6S|]68ye)6nZA l L;(x2]擰BqjBjxpuv
sq&p%q~g#S&ɂ'=X_:%Qȸ3Hnq\0o@ D ))HjƴL 9n3$q-нA糺# gbpt5 nPܕJSs( 8f 7"똟X'c>=7'S
AH@!a,t ɣB`tX~Eulekka#-x2|<^kFK(9v94J6rHt*AFhMZLdMSjr+RY!30, ВZscڳ gn) axqZ"#W]O~`4*kyuE,c aUbԭ-2!G_?aȡKywqlCDq@h&)7;F!yj|N]jU)eӓȆHiH k \{e&&֏fRJ?{?. n֑N6,*mߑVl BS n4Z< ~l+㮖oNG E%77J$aQklYm=; 2 %'&s9Tt[\A~jr7)&/":~un%g iDgaQlD +VKR.>d*9qst8~orvx롨ZoZ,`_С.ɏ Oi3v+a».յWbP\]-n:HB)XF
cW qedF[ z%pt"\!g97V{A.Ło+0o@a_)g2bYkxqs
*/:RkLsT"1fѮqU|ORLnb253bZ# X=@{g; .N#
b+cbӮqǙȥq`1;.wd?cc|G(f Ցri$ ,M,RGzRcΕ]aD #7숟b]7-&v.:hhCx>'LzAjyq
X P.AgvAMF#^ lp]V۬G3B.n#}|
,ߜ<(8b7Rh3'BQ,̾lZH CY\"Eq/e}QAՏ4Lۿk=!?ܮXE1Q JZ +~ _|W%պG멈-mT#? ұڙ @ސ RFPq6ފƪ)am#hq1`Rp i
#Ƀ7r/lTK-`j2^t{EVzȂVCG
=oѠ\ꖀ)✖s] w-AEb
)+{
_ aAU2?r, %Ө.0 4c*ك?.9ls>OS| BN`.A=HAjjNRCC8.VKlr7f?vIg#?3"
"znט$+
;:iRT_7O/0_q>YKRwy ?ذyM D`/+(T[pb!O}q6ΒU0M*xncP4b!v4OSGÕEӶݢ
= NTƨH ǟhi)+ 8'{^
ҔTnfc0* ތE; זtMҕE
Ew)i U^]1 -ǍqJ&X+F[f0&hZg9x- ;QzULa%""WBƬ0yN^7ӷxC`6 :qEA#F &Lc1OKtK_9Okyn{GPIb:ڣCD E$F' %jY465hu F :qfTت:5BkS9k}v
l_ѫA#SOGn kو`D34F`%cbjt=%4[`1(ةc7bcu?A.= qV9"M ayFqpg)]t ;zN $pT~z y'Q: D]t R߇*E8#?X "bp/}5g k1Y|h[ 'T9V?9a 'oG{~6m{^ I܊ ;PV-IL@e Zt1T}b[[6.0gWE(D]i ':IK
M >@;u2P1g?Da5j]wwu8ŕ%RSF;>iUP#d=2* $
(r,:(jZ9*Fz\NmXw5 VY@T8[J] O.Oy:5kn{ƅ>~ߎ F;m5
k(δ?e8V{W,dy HSi T]% ~-REkvNMnTq^{Lv-|,[ sa+C"z_<^}VQ׀a=J$` XEeQ 2n*34 X[A
iӡ 7aCR>-u/dgY+\ҙq,\I>Olc Sg`D_ * Fr@C?a!Ew"D ߹)DZ COX[K?M Nw1f; v /MB: ;#fW!ۨ (u컋ԙ1$GeMoHDv #t~ +˛٩ ;h:zHVCcOFOSnVv9$)>K'-0i}>ڄ!% /M!OOۅvTX\p=PNQy٥<
ٝ " ʈR(ӝNs!+>Z=}xR' J,xmkj{q8 JK!S{I {j_Lǹbv#lsdfXo4$+O Y37%ĭH rx2RX)fȹ 4)KTd[@s#t!rcosӏ Oj xn%1Dڻ|mVBG'Q! #Z6
dc]| .Cml_&{]اM+@6"x/j;4ZJWtFAF,:{?}C#6fiK1
CV9N[TPv1D8:oMv0ӯwY>S8 &۶iKA:'Mw: ,>o\6ZܗF7^U'eT&`>uJ'|Llo=Vhv棯n;RbCu ZfD:FbR;s @9}@ ^=i RZ8 '~WA~f5ɗ;G"겭AMԠu|oN@OCF<;'VѤKygWQ{
P ?I,% yKshfs ))OtC@
_Nv֛s>n$?7bHνDUI뻼=3?;ds 9R_ Og KAA % jzVrbXG0WKRIdD9ݢp#S"2πt/Ϧ
`#^ r(C(* ޮCjlI7+ M5xj% n) ZH Mb~("k d ]0kK/ή &2>2h+ɋCs?
T
[O 8QH'G|I[1Z^iD ag &nE5JkC6@N+r\zloy3Cf5u
mT0|3S2hÐrs[E2
iN٥Ϊ?椻 R~s:jA*;4Y![]̓L!Xƀ|~mNm E5R>ݤ it)ggȗvt5}9YuVd4#AlԶbQB9En^)쫩3F-hy u!5L;^9۠N 0g$6ÆrF6:_ԻTߣ(;)SSEh
1ev)<3)p -_$ ͺV 0>Qؓ<$ٳ"2sujJJ3#n b#sW"T;~>
5fTIٔrpIU^
âsѴ' C[L3}+n>) ;6|̓}l%io~m7~ gQh82\r6ɠjb}hy,Hȱ%TAB@Uqf@RnL7.XqK
Jo/)v0 b{n?Q߽K 6Fk8$&t A F}+$֙n(u_Aw>1I !21|
>M 'jT/̽`lt#A;"tFo},)/,yc3~)-J$CIv~Uj-JKz%fBq
R[Oe B_nk +VƝ@Z%c܉ܣim%#.zm#WH (5FnDmT0f?Z'~+4w\ξҥju C ~ UE?TdH@G^A *t #sQi=*|EͿ
%NL{ ©RNH:N&,Kܟɠ Y2s]7.knKlhC/CRD(sڵ!H
Y 7)#
$h9CPZh ۵蹨 #Us?B>q&r4A1952fu(2s{ H]0<(W]htg.ATf(mC˒{4
, X; y ={)xF&y ri/4,
fɔZd>`y0̍Ed fH[ +I}w)I1i -D^y:v YO:*Cڀf `>!"44;Ka%f(=#^E5k
,\$0tiKxe'Mͮa x;=Z<
DLHגluCoƹvC+Q\!aD~@ K Ӣk棩5K۫BWLU3d
uZ X7S7c \k#Cl?wb._W~} xM6zD )ryze@vs%-: NR J!Lj!X6oTbD%,l K U*dewpFbVrcowx;9CnDcнtmd5eɩKHOö飶h)88.g+xo?y蒍r:d"SQ1
.2S|)~هkؾ7: Q,Ѽ{ ;)U>in6pwC u[[A T E4o!-j\`&=*FVzah}Ȫ. F J5 '2FN)* ~рG{Eeg| &J⏮R2zAg 9EgX
g]ʞ(V
\(;.3)u9ߡEQtlDQGpE `
8l3Д1 }S\߽-awGOBJv>6|2>9Ồw/|>?JlsW_fU 6V0e>0/be"h\8GK&%tEWL[s2H Sk9Я5VU#q}.Ύs`H(/*3^[ =}з,Ņ6 Rjp#EqTiIOW} .S3W4Ԩ,{xuEAS\: u%
K8,E (X }ԟ}w턇ֈbu6֫Lɚ,5>7t ͯ*
fR eclNpst-2-feډGvV YA h^Nc'fb{q HJֲږt<>yPѮ2Q HXq&Wc
Nk`c5|˽ Ee *j82 Udy&
mv:/ _; }8zUT%.3A8}LH'
]?V+w?ko Q?~h&c3AS4s=Ծ҉`O~ ( 05E
%jd+Rd&|}~u%6u` {/^= xTqA`ˣhOZ [nBdEq*I5oVAWbXL$1 o^֍xt⟺t#FsiÒ?"o څì"ֈ[LL5Y|jȡgvFoڭhJʻLDpX̓7
z9DŽ* gbKf
T / eW},6Gpݓ0[']?
ySeNۆ~[b;1ׅq^'AbxӮo fEKUQVQic !v D
s(2[B/~ˇi a_&\2U6hJ
kz ҡE 6C{'s)"({̘32f&'n>d#Cso_!7eƺqR۹ͯR5F#(++#C2~OhS{z8lVK kbA'krô j7X?ڤ>m',znJqPWXrĐ:A{gC d9 'r0_ @ܜT#*i:&MV#u¹t/WD}2}\CCi[HMhT0zbv3PR. Dx?c<nb诮c"cl | m쌇W7PQ/F ~g;AW?k ~.(rֵ(,Y&jeGE*CuݦLOrYs0b)wtGI A/hr`Ig[2܍V
NZz^r3:o}z4 9܉S2\ǡ#G }T 78 "W',>}vl(B`ԯ0
ȲU2*Y ~A #b3
3wg]; i]?kMy P. 6= kȞ1z] 41$BxT^,WR PSEέl2]pL
1Y
^08}4kt-`#dsj^; OV+*:4⫎\
>-:-CV4?üM ާ2٤xfT 8<\-КDNF RS@g#iZ,tOt'H^|"oՌ; nw;neE:@77gpxeM x?A Cހl#8rQ,K'gjFOYy[(@PfswH$\<ԙM$9N ZH&-C"l.1~k8Bܸ$_Pj.d6ZTQ0*
O[lڲrf[1]:O> mF><N2Uڏ) ?S}%'vC u~s7Sj_Q 3ܟ6'6ρ[~ua83y)-8^-}G/O Gԡ |Z
~('Jp<0A4žAxs˖;м Ƥ^z8)Ol@|@ņ
Z cĿVP+Ej(F"_$o.~|Q3
[SS ) GA`vFŭp?`g$n{9dB y`xaP!yX4yO- 1Kaq4KDD(oP)x }-K4o9Uԇ=5K8-N$; KCc[Hz~}Gp(z]7Z Xa!ԭ ZJ*lqƭ1+3WVC&sZX*=|>5̲{xR IZ;Db=DB{&1\$yw3 #(D]xbRSF0[Im:S*ǨyÐ|{xTF]K{d-K(MKO;
Ҍk ?:`'G]*1Q]&sbPg= ]qR T*#"f
"5_z Cy+lcOhДխ j&|
[n}@]u't I!~Xr5Ԟ@ xav SD&ٺH_ Qm5ʡ.PR& :O E99ޛb4gw,m7dr6Eb4
-0i[xJzNXEЛ9P1!}Ű{J1*W t@/T0j J U98\gT?Հ\1F%^j bRQPu3OAoêr9jiy"D ZcKb {ڰz
. ::.0㕤 ̋לe40ffru`OhA=1MBS)b0pK?_fJqėBw"z 1i-r
nZoȻ02_fk^-tT y{-W\ғkQ]\ = ڤz^eaphV%dS^0;v{z42.)jE}~"A,7K&2
op`Dw!e$<\Ǿ~C?mȹk95/O6ث/&Ev~U
N|DIG7Jzx
h_}KsJ{
*pXM q=4Wv8ǺJFTXܺ~fO碮p 7n>zolۍx"a~b>⥢kKg00q7t@;& |nۓ!{-2!퉸e ,(s+2Y0۸L0RD:o 5> QO@O`57;{hmN!Q85Y~]%ݻAΧX ofӟ:֜7e~&4tQELt#֣Q-O)睤_Q6*j%|Y jy , TiqnYM n q+l ^ưt=3ՉټVi
K֭Ɗ+rx{-Kl}ai;3iw8X İ%>0hZŻo&yyx
[$LtIVYc!ܶK=zf_n3I"gk#j0M|Otmb!N|-x ! ϲ;Fd?Z8S)[-e ҼuU$2"- ^UA-&J!nzٔVQwkI5 ]BC9 8 RJ,@H0 o43Ue5a"*_"zFEG]Lp '< TN I0А+74+,=%2RHьE]9*eRKgHܓp&@}sɂֵdE.A
k}NoxbR1UGп廉z: eWL}0ǝ ]WTw ۖ ։22+SCZpx)=6POԆ+ fK\ZIU% n_wݤ6ub@(mU]4=;s ',R}NGf70gyӒ F"k F98ڏMw6Mn+f^WE{kjЬWyE6}2Z4ћ1~rE-Qښ1UG}Ud]+ (
wŚ"`
֎^:=c}-JUpXR}ٛrrN@/%!r=d#pt d~fs8o+4?X:[m'Zf7" hOAӁpJQC" 3&0Ď;5ȽqM y 6Ne5
L*.oϳ'#M\h ˚
Ƌ {^('_+}+ԧ;cѽ2p
ׄiIq!?
`
-ԛ9 26Ɲ1NUi ,`*+c CS cl8&:O7~P덟9v9 ѶЖ9x4?Fv9W{3Y5# >%ӸޠK` ֧z.m/5 d?veZX Glz/et7e
wD PLDjDIѬʿ>FUV8g>!\\+{;#~M*utNB pB[~T7r vۗ\).Ǩ9S M/>=Ĉ>OGT(z(-& U] D\$ܪ{~J2#%uP+oGY/L5iDk)؞ l fSzui=+on ={_7M6qeXϻ '*}(MU#exFJz+{6.:*֝aqʹk^_C}_oJ[-YTޫe)JvהmS
He|o2W?֤_gR@SM(D$C1?Kz ~PMx(~̥Hf
KИqG)Fa;숹 szi,6)K4>ЇnpPݬ5' ˒Ϣobe=a2,̕[E$Ҋ:ɤZP C&vT,7C 2>lI! ĉ%[gyYT
dŸ 1.Nc )?z|"` K 5Yɚ]oߨuTWd]D+ChHM$YQS@QcL.ո9 m̏"`?_,L]VMR]*v\'b?+mRޜ3{kvF nN ۷KJ7_ h?)
2? n(8U+;$hſXiYu=OFy\{JѦ
4$1' 3 nZA:Vϳv(XR& y-L/5PP ]x ieLTn-HB+oTG
-qAFL1 7&=fލ FZRwf0XV ;Vkhk%2D]H'Fvt9 .ԖanuVΒ
w v^(P-рF~&}KoB#0| kh\yL)b Uݯwbx : lp
T^hXֿz_Ay$1+k3e[vY3OD# s |:w͠k
ɑ
u^y_A]#$ %{0 jPNi3O cn7䞥vP玊#X
U B7v^H3z2'@FA]ƆvYnsD!Z|i9}Lĺnojye NoUK3_Nȡ Y_ c²T+9_% )k,1WZV~zw vtU7U `%7y[r vgt!jWOpv?;8? 0[E65 36RZ0'́ Rwz<)0 ,^ m)k+{Op #4]bH @kHoLY罜_c7U7Yq
WUji1
UMH#Y R >a d/xlkHt4P l$-Ы
|W;"~/*tw*P! Э12AJ: &e_i/ W<^%
. .1Lz-$ {q F`f
:mz+DWw6KA}7Ch azA_rJr+2Wqr6=*@}bRW7vW~7{f>$*-*A+ޖS ?FЗ;u楂M.hCBH.P< u?)b1g㴪c@{P hE:u6{@ d;mo2$*RԔy~K Ś"儷&͟U vx%u<Q9!JS\ IhD-Xktڨұm {1/Vp2nZ9Sg,>VܥXqho
+ƫG"/ X](1lB!HIHdDOu
,, 1#*Rg*OGwhSZȱۦȎ. oZ J` :CXͅ"{-9Zse{lZ3V_P7<`% Tr?"1l
4 &.eȎ(tQXЗAB=f'li ;mfꮖ `!_1aE+z%f; N/G&`W'K jS
t -`=߮,=9* ltϧ Zzɓ!k݁UytMr`kd=#UZ1B_y^zQ5 o埵:Љ'ee:
}!g QPt_m0bRk{GN,Nqd:tX{t+Bu8ս(4a,\+DAX 9@3%ʺ:H<T2w#pMmFtu
RDM:t27y = }l<rֆ "vez)^qg\s/c1 r+|7:
Q*:>,# w'k r;oWZ B@J[5((i_{-hǔfNio axqK rq zmm8s>3P&+%sGS4 P(] :v XOzҙˢ!X
\>JF6lZ=vy2hVJpIw9
49 Z?bN,i>`4ph,bl Hz+0ϥ,5.dJB:oлߔ⏑ˍ'ݐ|ӷw |־}3HLOf1} Jg {JՖի/_Wc2aiC ԭJ
RBGϬ=Ȓ2EԳ͛ cO$pT v -^8A/,) />AK1'o
ط$ W\L$,MF7O ~aPNΏZt@N
P(:OƵrLT_nj1agýOi(*Scf)^.{_n%n[!-(:pp!n9V3{d6VVYsajL[5k9]UjR ?{H#; :nؙlcin!~1zv2͕b!g;TnJD!*2bqYӭ)A8x7_En@d}E?D" yײT8zZoGy71O-lم5Mѯ," YiQ5CGa R Fxt&3/ǏҦUئ 噉MpbrR%X\궥Չ/f1Ə F$ E b<#@ɆX"iO]zV脂edmrΌ;C`DQ.#$A&6s9Xƥ!*JF`p?WhɄO[/de,FWq,dv~Gx"1IXm}m7ob!(fkm7,Ҽќr=} |LGFFѡy͝ !Pҁؾ|#4Η$Aԝpn1XҜx I4oodml]s- {%Rhb}=@cvJnMWĄγۭ
kPsCb6$?ك}{g`itH M&׳`$Du9We(:}_6rz5/`ħsz{rۇDbz\\XJ:{ZdR|iBVe<;Fd?n'h S ?{xŻIN%38{HpDN*RTaM, yD,?t-(ͺc쁸Z A˸vW ` ¬":"Zθ~T1HD`;4N$Uto3m{ܛce }m")s>Ss|!
;_IV,Kc~@jnn[H_#i,eiLA&wPuDNѓ C%ɒ)n2+"^yT3! uYH`
)(MѰ L>lC CV
|* P$jJ GB0LdYNvclǸ
n kxo4cC5Ȱ myBm
|Th|vLO LㅨCN6
[Ý@-'Q%ؕvIyWi2%"#0NT,>H^)rIH"?K}[R ;uiQ |rU"Cci|.7.!En{Q 8UsXa G^v骰4 EiZPip>-tF kDn F#0@h$oCXBYf r{ƊJq *5.6-G4(!3>fc-
o3*z {ib2 =]XJld:k)>nE վDԢ$զ6 +cb"- Ӧ|p(ZU^A g5cqaU%s-Z5s,lV
R@ >|i6ɂj~AѼDE8 qrjK##;*$z\&dU
բzzOEra~ e!yKη7 9/Gi &YN.jxeϦ,hB=B>Q1C2w'8wC7VF~4D dK(u uP._'m]=؛:k դݑ T(9D ί\
rE< wZ| u+ ȯڬT_Kf? /ړ=ȸ͓O+ 8oJN/G$JVbp} j# s?RISt=VF=p+ qgrv9*8 8V
ZL+0d} KW w<|<6 z9?, U=!;~b~/#9
)B =<{W%hRQ# <1d
b( jnhĝ)1%{4,Mb
`V m=Jɾ<#ۋ+| ++ OG
63dUPGt+yE<͇CEK}42DcLs
⍁u=Űa@G3lu$,ƈ\Ar N(X"lT~kz2Dia}Xܙ"B ږHPt
oh,N&zTg+wj^T0ɁIxl5b `M0& H#2Gbl@'xƙ zvm MWVWmA 6g-V+! k1HlB3e \`Rl J>=MOnz^b }8}gqɑ-BY,`AXF;Ŋ<` [M>!
>^*i%,>d' n !=+Rw[5S5n;Gj)Z?=ES
P.kLUױpv/"
"ѐ#P9P _Bv
l_rg aΛE7!ժe\J8-C]kW [Wu h(Ǩec%P+$ sJRl)¢IVk p,BFg{)I!)6W flTTcJ` O6\ CutvRLw8lՄ NP}7 u=]ڒB/ ^MSU ҹ=*;o}P;%yւf9RĦmUPvd.&N}8LD-7i&LJ .5V:0G7I ue3t43k(E/E26,8W L@n t ù`b+KE@v,xq~ulx1D;0}4䭤H0#5h8UNrc ?A\8 ! oj%濅)u.5@JޓYNҮ,b878pӛr*TF9L}Dg>؆V6b4H6S ǭ$zD-$
{@Ss /ƱIVS]^WM!C4
h/b.->,q3IK5$.4W)c`Aj ~01>6 nwr~&NrYG[N2wf$ /J5TP@/,>g%w
B5k:o2
XK7t%XCϝ)oVh5|5ȭuxێ_J DnPMvIashF(DZ+e<瀸d S<d_gcrUT`Q4X+-PsJ`{}δ.ع{#ѦEAb5*6=B ŷk"j%6^ :xsHC[qq>4sh-Ay
ˏ ηzw: 1) 0r85 EgκXZ$:"YZqh^? \:ۻ5=sQ39zU tb{ ^괬=[ zg7
1oz(YKyf텬DFl%%s iO9⑺ݏb <8;AiіE!|Im(Y-y8@~qj;eWAR=
X$L%t N@3U h廧&8ōp;Ἶ 'sɞMZoy,2OLt&Nfj},C\^bE&KbgpT92T>Jw/ذl /5:"ЊbxD!Ԏ*jp_aLd :ZEpmj
43ez:.
iwzR4Zq|lƤ:8ZmG'WǴ{ @.u>c5%JO>.vpce YZɏ)0,iMt$G\'wXpWנ], ͑f0妷,42i /6I\i`op[9t92BWsJ7ʹuSYruAZ7Saƫ
(rOWѩ=Rby.r&#fÝ?^J\[l3I|~Y( ]
mX1Tk=Dbnc ׇ*>!8$THp AkEt~) !t,\л{V>p,ˮU}A_<>x*KC *éfin셕Im dfN)3Sx|3_m.?B=Pi v $Bߵ Eq:Y:ʩ*υYb_e}>'A
%LU:fVw9͛(? '/`GNl6DBwvߠ<N2ĭamҫawyF*Óѻ 9%fDwKĢO% rP`1eYR%߄blT9u،o}uE9AѸ*\Ej~LQ9M$jsQ k.+:@NjR *_ p" Xˣץ|{
4n
xYse?-I]/h<+&GwJ}
6@<q.s9D`5l#r(ʾݘ֏9Yd6خBF8ŒwMp>4MMv'kҪc0$Y\mLKy2 w:A+K◻L^*Ue4$GxJ: ݴlEݱPݾ? ]-D
}ց.A7#d `,5 7eT@uV=2M
L Dž5q~˺oZ!/{~<"HeOq>ܜ9ǖtu C
]A-mN pX$-ԡ{ų{Dvofl[7еenw'=4Ljj_e)
Y*J"GWѼĮA88o:Ѹrx7%#. z |"[D9s x£ ,օq=/Cjm@Kqe/
b / PP dQa=dzΝ1A`U vv<#(5Nq̊% \
da}b%Ø`7o~h]&
҉7xbrqr *c;Pg
`,)P
K, 4&99D>N/@\ΓRjy 9 3JaoIFS
<֤t1(` ># 8@77Nv WV:^88O4Bwq,8V [2L7a_ plbZ7}BL GOR9_|a 4OozIԼ,tscY_ ]Ǟu8 cA\K4n|yʡUp ;,s=)O5 Q`|Qru6RYj -ip?N,|*/m6Em0w9.*k *dAĕm/`G`pΫO[4;"?f1g>|hTi|WT qǏQmlH=?8V,ֵ{|w#2۳_S ]a{BܭMZG "eG32]])| 1 ]=Dz3 afwְW= E2?g{HwzFW!+Hz-Jm?Y
5^D%%I~Rac B1q\Gwxj d}%Cn\?u@oVhs:(NZ!*Y÷áHwjߎ
Jf!ɇXO^I: ]PIgqmՆ0r_?NkF/oYbUe3Uvp*+FLJE9ƈ\qL_~Jΰ fv ";i[eHNVo
Φ꫱"|ra
_E bN#Q*m FĮccw" i 9g@I(i] $d9!QsMS~qZ$!OqEmd-MI;u7 \&)D2+Kܗ.0yHpmDHq:U%axvm̓HpU
K%Q
:L3.B݁$
Tw<ڻj>o,(G"g0AP)sogOٺ[QFl *VZa0|nIntj"%
%&a$䇑';Y|2RΨ ۛ~gJJ%}vw#\ d`]-w$|mΤr/OaHq
yWOXn0 _0{iOKyG̅#a)) ۼ'jg3t/7FYM)'@nHnPj+k|haJ
1 Q\ -G$ _zw͋)y0Ӈ> bXh: 9|p21qZΏ Gh+l&ݹe@k>E\^=Z(sS
VhKXN\\ ܴEy_SwX Je֓舎wSsL~o楈 x,;T(+~!O\rPZAj?Kn'cq6Xx|&f5~hʒ =IRߝßWFq uB*&'8 //56-QmׄYSXTdם3o$R3RoI_ٞ?t_>6s*bK+%F!NkriհXìwҡ/nQeFzU5 ,<22nxX/enp~]tv2dj!racؓ,Wjo"o*]Q3Gl'!g7GWvsVJ~ nMG'76&&BIL
C ]$x.xiqgM+i4d%x/|.3
jJAWRT//ul% Ik; p&('yIzL=1H|,s@>JetӀ9(=,+W_Ē4q`vĨM*T&oܥg b-d*:wJ5Ve1wP[pz<[ V}0I}H`$W!1$ XڶΠQ!T"VzQ͑ӛjla4,0tU+&J_EOE5 8&;OkP=ٯ`l#}cVq L* I)!*ϖWއ1Dk3 lg p4e)* tmsWDj'pF` ֎9 f!s$ƿ{Wo>NfeQY7<1^nU z\4fIWN},m>[6+IKۨBƦV
1LU j ǹijE4_ jo/ @%PzLNOrn&K2 nN4y#Z&VW}|!
I}Kc4ᡝY@Y f_n8/l+ `
(W0oH*2g?Tޯs ERrGS/`>uڛ.y~'K{),Q+JBCcѝE5+6+VwMlKX Z
.EχEͤ1Ҋ#eA,Ic~NnF˶QĚe%W*"Af~GcFjބz@ a簾̦iPlu7[Ζ5W% 4؉ay|4e^ذ,z*R
A.^Ufp/=Nr/zb`(o[PƽR-{K@IluAX?K&IK{`E(Y곟 +TqEImBԖc(>k/DBJ7$Rϔ)k HE.Hb@#C# eFhۉ[;|3@67%GmC:A/O֪,)EȆJqUz !=
NE 06(Ɵϻ$v̶^ݤO k hu3]^8H$T0NĕB[E^S"3u b1w
!r2{oH/ >G+*Q0voCQ̲ڜ.bxA-fN -宷YXnO6)bi,6֥ImJL7lB
>y yBUm CZ<+" L#Y>F ^
|r`-ZukWp:u0;c uzp4Fg8V /25 %aKV\I s
=7鱰Kp15=y(5 |(]]F~b2| ~ 5NwJp2ʯ )i_1Me^Fgl ]
HS,
Rt pw QUAGҵ.R~{I]%.؞c8i HIQuc3 鍠kMLP增y %dh*U6}DU2I,TWŧ˱*5
&N62.\4m0k9gpRBQ^ l#%tփ.gf,oU,#OQ*IfҨZ+n Dq h$I`:Z{+qNy0(uj%B+P3 :B6^e9+aܢ uH-;ܙ:Fk La^(Y1 ; »i8Waꙗ3mќ/" +_dMa
2Dh TX7UCp-~) Fue\ {;{+A¤pdmggpDb<:]x-;Dؑ$o& WL[]ƪ)كt*]8kfn!$z̖ 5Xts^:? u6݅lL8ehh?#,,Z :9$ť=w- +T;!~\-.؛x
I>Wc|Uc=["^w'D3BY{5& ;>Q;# <; g>;,pxχEH7HWS̩ߎkϋw#c\\dWe ÑPPsfM=@|8jqG^Tj{=#k^ KẁI
5&V**
't]NxP@d:_A͓h3Q/}ucG2;1^`64#5W/"H4!*+LIg.{$ 'Mks@%sw*s
SUlcV: \
` Hқ?Ql2Mi5 jSN;4ob4䱢 Z0c:OV86 Qm 9.J=btvYQ5}`5~CIX{>M9ѳZa
mw Lm#w&p"u߷
K ^E ?(S[J[qMa)sw
&&7Zpm;7WnS1DNfM(GSYN/@IBɿ+@gϻ: #w@' cI4K?uҠ Va?05}#^4BuSZzç)*~"~h;Z=,c&~8 xiBҝ2-Fm6꧄K@>ܛ*@W/ Z'RT#9}LC\7uum/N;og|E*=8ˌ64?7PyfZsC9 ; <G fylQO ڹL[yKq`;5fy(Ʒ34o2-Jű& oU*o b1b
.4Hϗٟy^WօQ<
9`wt,]%Ӓ?Ӏ.V/5''lݔ( ` X<oNCWf ֨w>Ö|{tԗZGĬ0Xs)bc Q9q9"~&
r:!* OYj-)JD.k d-^FY+R$[~}xGgk!du _R$;yca'wrLk0 lY ^,UvK6U]4u%0\/U+vu_ \ #)DQ$w3DMPϪM>e*r^X 0+U) PP\N Y6{6n 4]`lue| z:!
bZ :UE#;Q#ꔡ<.ݢtѽ@-җrXfGjE$pdSg&;"N8+~ iu![7wiU?sQho 8Wꉃ^-)R)D`%!V+jna0hcL-8-ywk1(d+Q ߒa`V>vhc>8D "*!.%Þ>_o [
nfA:2dE ph}stwM;L8&C
.| \{cK}Ćn"h/ARyAVD!tuBKpLO6:3LѶ@{kֹ3=mT;f茥4Mڳ|| VvRZ? kN i.u xiv[Pa)KV/. "9Zն֕M6&6o2r
l1jd@4PYr
zc_к'\ :Pl]fg Wv43 V'"6ؗNJ{H]*<#{8)pq_MmI\GӵqWa$%t*ۣV]RcWdz 55WR؈4qFk0\?QNCV/nR@, KV< k/kMuwn=qЗ㺪K̜NM9rȔ :3Z XJlR3*
w/V:& J S@HrĀܠ_fŠY2zIeJ3r
`!V'^4u8AA~l@rQ6ʊ j RVj9kФ9=? _|{M:Ӹ"H~-T#/ |F78>}:-*-bw
d u[; dѤ|=\55zj#bx9TA3b9 t 9I[m&崒فPӛL ۠,܄ؚ{;iG~eVOW}ʁJXYp*}w-i xPCB ~om$! {Q{6ùvhD4s?4KjQFn2\w%DW m
,yP>X >\wmu{ʧ(諏[ap pos
.^J$%YoQnY/
P3Cp 3>a >j;mu Įv`2=wS|/\P33שfgm-FAkst"섳ejljݞimŊtD~EAI7 ~HqT̟,eC+0KrmEn~<=4Xj@?Cc) rb.bůӰOo\&LJo[] R 6Я RͫQP:}ʣ[
Eh:=+ZG_4 kA*쟤&-0Id| s03M ˍ J#K!H8mD S!$SdXnVk1 3cB;fodYh?IC]+)/5ѴnĆⴴncC*2GcH&Cq"TyI
I'q.RjKWgg%˥u cy
Z 姥Lu:EJ)GH&Aeg]yvܠpG3 nf[ʅӐHFG?fΉxj:B= ZNB9Da3_a2wv)IF9>t ,#I Fl| mÝ;b1B?L@E*
<{C5H{AQÁⰷ)A|Sk @^^7hGO y݂&> 0@<>؟/ pB;l P 4=G<_N H_LL4*B((݈] Xdg15 HC d鑬\
2e${DO/e[rՁ :K
f&Rdǝ睒4Iw/Pw~@9q[Sў:NZ0L3Е50i_i0埐g¼Q_PTC i `MBY&5+q=+[o Q\YUn{ޢsf~a7˫ / ,N=xj}w=Նb:aeP p!Edx8:vQ=~2MyhSqSA a @2 @vY˺)@VDbCT18Q-GFW݄
+2iȓcbxPJK%M!'Nb< Ӿ &Z;q& kAQ(dW0@` ^5]:Lfm5,a)ў*h8oW}h~һE4ax2:,Ɩ,Bzz/vb~|/E2/V]}CpdM tlbl~D M+;N+ Mӕ: c=H,6[a [6zCX '5L'h/)QCr.V ^]M"TOtKdWTO뺖M^g+#딅 /Y %aKdmVu.Q--J^a5'ͦv_P&`H, qXvl ")%F2_*h]fC)E&%D˲s,WL-v7|98)3$֑6;҅k>ʥɯhk" pZShO((1m~ÕDGB ݢbr
}f=(8@N
MP1? >l^quxh4Ywgl]#QhL%I,pJt_VuHᜯmy&r4 ZQVl iP/mY] ec5gqJl(U-r IUh]}i^vh_]Y$- 4зǟ2.mX]$npaG}ޘ^(׀JHޒ&ϔBWVh_>FqS+he9?rCS{r*̊K|
w7X0ᕵ#8{3EЛo73 ;)HUԮc2dH>[\Ӱn%OS
飾i 6oN皩l[z ,i!W+Zn?܊KF
& ݉vpלb)(wUf?,H Fz2"'Sݔ]׃mtN*ݨtW1 o]~h{ڽ >lmE 2h\}A$~!P!e6G :lY ,wGxp0Q|SyǗTe=d|&P<! ~ =uPk7U7/+GE/$?;qg,] <e{NE'YB|.ec-Zi
e Mu#Ui(ȱ5ci$@egl>
p8Zd?}4"RyؖvJl*
E jˌƇSBOt- 삪jxi;ϗQl>חjoNXMl?|1 9)}xHJnfj 0 L cw I PK ٓ g ؖ/bm߭g^i%W]d]+lh l }&QumLȩP"
+ 8SJ%M=B>lr6j8j-GYO/4ʘ (JIfx-ד#mMr %1% +X$kW0J.F|}(MJ!}) t
fBZ
@`%CX}JT~%bw 3mh\3tB[ǿ`6w_oz M fi2U
_6 2l(,Ѣï`
&jNzH5I[6^cwxEiK
_gb6ȿB\NZ|d`MVk:dO`3eX*ןy'*˗_Tx-kk@:@`=m[[^ٯG|C!iȼĐ:z 8-}Lj>aޒj@Z $楃ih1>æuϹ FhSh1Ӻ}o>_} sPüvt ! }j5)
Mv!iۏ0(zhT
kf͐*KWAD@@z,`K 5auC:邔"8UƃkuP>05{'(ƚM".b_<'5
xp?37 yEdt!\"Ra^*4?JmMBĩf2 B t.%:&=a|/aLa7ǎR$J rC&_=$ <`w Q.߃vc.[#W#8JM e 1vP.JMnaF='J/ _V`AR.h{Cn @o` x|3K2cgu9ԚZ
cQ ʅ?
AV,U,#E7h|S2v<O[.$Bu\Bz o''7]`@X1 ǀ7o]Oo uhAnf?p Ⴥ֒w{nK%>>S8 h X2u~hs#!Pd;e$̯.Vq4_g3%
f)˅:ڤrދ)y\r۠!g >ȱʆ!߸
=6S?3Ze2>M0)ܮ8Ea#xuǸ-, ÍP6Q1E:e@Xh`I1xM}_{J14h0~)
YAK+N{ kӔM _rV6u:%uT0_~ڪfB4>),4nWblӱ}G u\f^7p3{*gE5;>ѓV'SIG_AJ\F;c=Z+t6^B?%tT;c;e/9>CIA5g1u)Iee{!3Moz̖;FZϿ} aeGFG]Us|~# {*zj., bN3}#136 MWSӛź s)PahϠKX5C>/(A\^+` 3Q&^?` E=>tyJ,,ܗ`*c8xs0 H0sF}g[mbUEFj&KޡNgΣj) bgկ1k0{K>,2 .M: }ᐐ8? XU-ɮ S^AF -uڷ]i0*-MR"߆gq=. wK5),ɍ5ﮌu(dZ4k ˒g253D>4rq B$sYC4b*dl$ʂ1i)\t_F'xa'i (9exohbǭfVBJշqv~֊,仙"4僜omGV5K!4.npؽ{/o0$U pD$%If:B^tdݠ]c-P/;eY#)Kf0!.5nlrE6'_Z^L*ʁMs /r,#bYal *"Wo3zΰ#{K @8S(OC {dM' V z+(^>:
#Qu4h:+=
M՟z04dܧxM7֒pֲUFraGmsS1vh"qEHw) <=9q 2=ͽűul[ym&T4Q)l 0 i!U)# Ot?ȟ8A(`;wU"HŬVʃ9l ⥇,8Xܶq YZLօ୨XsJ:R0{4} i2];|\'ixr$I.}i
ke ҂+BRuE($b
?p4Mi,a?%!CƂ+>I%Z~rXK G\RA9Wu֍F˅e 1 }c]_?=z 2%r
Z{a 0H*T+Vs9EfUˀK'K^ŠfoD"S]*C rAV9(|ck`هQý H h[%MyЀS7YrCށ uic ./]ti#^Nkg])5 U WV v"ȤeS@sv4f9]ԩk yg.Qg#>#TY:Ę֣I SGr.&]a}Vy!jD#qUt_I .)
0[z`5|s}={0f룳I,/T.hLqGa NQ ĸDVsll#ÉwE$O˭ R[3]k0!jit^*^V߇:~ϣ^`eRH'k Xrq\6ܿ (A*]ɼY,c4اڀzX$劉v; <..Y?^Ě@ju=d~$B\`3_}WUl,,TS @ MxrZ
i&mQ[^hO$t)"\b\y/vN9M'B[b60r!+hxmܸ$ݚ=nMw^H#f-s]Jw:4 XqzڧA&Cy8{@tG y EG; A`].SbqPE>5E'=ae3,5bM_Dع G8Ō aT,\ *miĶ{}r]NU[:eI* ^(O6^ r@sXْmU -6wR'P[L
0yqv?Q-0FF/v2my~"APy$̺=5-w6Q/ V>Ȥ yce|N!fxՍK Ce F
T;6t3&+䱐yHɁ˽z
wir %?Gq$QŻQ ayG΅ɠoXB];F
l6Z6cJurȈwNcې+0Hݒ-8dЎI9 r~ \; ѣLgŏSoгA{8=cJC|I0W}`#_
Fx[cގc {s\ Sҝ~ ZY3S/)
UMG7QSC
E+HecXD $gGK~)
B K,继5L{Po>
i}JWL_`Mf&ؾJ\" 6ǗLd+Aԗ 3mS
q%i|U)@G(K, ylgkcۼHu"KY
y0
3ZfD E74f KDoe7gt4f I,US}-ׂD:
xw/4!>yVZ` ѰC[Q͐xU 3\H[$X(^5,Uoa]NRb4|YRo;Su &:81s7V}S[
r`UclO6UmLD ج ;S^b5
6r
M!n] q&PaXy$Cʩfi]'GN .5[]HPpɠ Z׳-]1yI`EǑάp.tс% MqGH=gg 6&('T<NYD뫿q۠圶 ^b(YmiU%H䐍^_oLN} &Uxeϰ3kTHaJVnӭwk,`_ n 7zhwE07H9ؼ qQIQ?uV]Vu{KXƁCoE gx{mr30 E?'r;U6o#i
ȭNU}{Cd5
dB\ ^/o86Mo(K}@>{ gW|b"m2V
&r yi6S
x ;CF-kCLgKr`
J:b8]E!{Xrj1?*Zլ!1I-( DY@ n=lv9XĎ̈́ 7 IZjI|ZS U^AB́1no5B u"#TKgbbQ%#=SBgbj ,
u
G/Fd%r< 5lta| &O4#v-)ѵC m`>="R1閡N dH5psF`_uJ\W#uAqt0x^ dAS[3'`Sc (nsoLYL!77e4\Yn!v.H v0?>BzJ*K RЎkxl:now 0D x?pTE(xi OIZi-, + vH%oHfؑٝM Z0FY3_UUH raBUpYظ$ G a»W"T/ \cCA%r2UEv|a}RZ_"#{ۄ)M e&x~-MOg?!IŶ <{0aJ"J_$m0Kv쩟 :Uy tr 䊒c78i0WlqY$C?9ۥڵZO3PTWt[F$xziQ&|N,V , >ӯY `UnS,oD$Xx1i= %xHRZ( .YΦvzW5h U }UP{䜅D?.s9kޘ|VR w_(:ͅSn@!k8q{^ԚUMYAMk ayeH|HO2LL6+\
*śPd^RknyPxt70B\dMπpc:-nɰ#^6U+Vf
ьT "ڠ9"ZW1,ss]a` L Nj,AḾ~/TJ15 Gʳޚv/Nfd2"O*C6G~*&8 O?0c9xR o/!v,WNZ YQcJK*I&4Fjn/\ MD`{oyxpIBwkIF1GJ͚8Լ3/PsB V]Ͻa ޞ/ ^^w427ϟ:S*q%]߲H'_ Asg5ɳE M͗Uxxv?iZ&;F?JF2ZGiSNu Ê,uc !O_;75Y"+5GusIzB9 J1
co&F1Pp"~V s2o10Zwtbf zTJ9J>>eA\&ydEuFvm&1ity[gix 6A3>zdfݾ9 nC tQP2[}ڡ]Ho~ObNY`vj 9 DpTC`ӓT]%' \OTp2Cj'@{sPU-
yHIBe[uEʸjkwO'
?DsPXNxc+qsOqa#]Q1K& #ՅRUd;27fEwгw["aMD~D£:-\
c$,X~=jI
w;WAb}gPAAȯ> =iK)G1DE+'(bxXGV^
;eΚ7 7,G9)tQyrHDP< kOyK 5H jGK {W_w=pWR [+
>K,igMݛ{6Wrk/DB/Q썺ng 7NVd_1!w@S=J6 ,-eŎ>z'5 )>@7; g~/KU1ˑ. 3wW8)j8{ @zs,=U
CVThk
\Džkux[pp݉IVĹeX Ģq'ax/4. mL
9>
8xa$H( MKH۵\P62Vv38
A ef 2gT 2g!B3mdS[@_!-U,]-ɷUM2$OIccY
dr
dT]:Z8@=n_S+Vמ%Xtsl\d Qsv+G[%/D.cR3Ո}`gοPm1q3SI# w;"jmz:)@ ,
IF qL!jmDI3sg~ ٩ -Qqĝ9X{ jP ɧ\6̓zYo
8%y/vXVezSLuxuVbnLZ 1Rϡ"mg Pg iQa{c [a%H'JAKq*v""0ZЁ@%oHfBla4ԾC=fliJ `Qh!%b0z
_l?̻ 0 K͚,>[awBIw6^#I 5 ,'Y]4BNR3I 'A<20 FɦFg9K /HX9` g!;ݕd~0 C$*6SD=8Iq#Xhj #GGrƔ0Qa`2 E8
%}%n.'¦VUĄЂ4<0_c7* [~zc:"WD*6.]=o;:ޜ3ᐟe1Puk䉍y6xf^PuLr`WC4Y,*|{XY8iat~ sϏtKL} Sl)Hҫswφbj9NOxt )5OzطJ M[
##b| Xa""PˬoD-Ul eyR?6Jz2ͯAs }=Ͼ.B > 'ER Z64:G ĝ7-H Q*9bQVor]xޕ]v1",mR0YW87ao:
\g3͟կϭ~yĵ6('CLj~2+ ;;:jg?:uA*v+co5c?5Α8 r<'UU
>5)U%YmgO<%7z]0Mڅhbوو6H·@ZzULń=i_˸ *ޭnӭk!sH!
vO`JGI y!ujH
=z:2''H U rv ֬ j:l }+qy72>N7ҋKb#g~x8ڎ-xֿןvTyk +b|!92ZILxa_1w&>jI./=! ـ *:eUW2^DY/_5Xijx.M]GQO=h- 3ġ.J'GX|aQpCBt3+qެ8M+ hq"1㳫0 W5ADBG_|DuE{Cb|jxM@PΧɁ&!Km3Mj*{Fqaf 46ui;`E0ۓoYSc;0@8
#; lh*]OY(Ɂ2%T waĊ|SՖ,D
CT٦ ::>x'ahA%c:}Jr}z$>Zd Gs*YqLCr$:.uE&@vSgcSaf-K"ICnŌ Ê#
9 Ti*=C}77;k$N-F>~DQC 6s崿{FwϘ9pXD)d"|^DnPU#)EbP rJ!z
5"-(EE I>{ +DC3P~
_% 7Oی"@3-%5C C
~\-5q_q.ogTj+ wLlt'hԱergAxؚqG'epdg&
Kf 4Z lsN̓vn6rѠ-
x^v8 |Nu:^de ZLi:4lO]@*,g;cnU!yP瀅iAެҹ A ͝'#C#<-qsG4]c%ۜ*|ſ_fs*pu}^, N@ ꃔ[XGj /yo1^բ;k8>0;v6 ηA=hv|e[kig0 f tOT֘a
:-erw)iKo&9(*\~0ZAla#Uz"hl]\+؞wC3_kZp] M42M~Պ鯻gM&S*4E3h GV5Í=%7=8Q,KJ(,?Q4IY|\o?C| n:ĵWv\ox5T8(VMBDGqt5/mݹ:|nỌ km
i@sJ)8RBJ3os_ō\ [a[WCpwpo Io%Y_Hɻ.f ʹ\8NQ&m
ٖMr%V f1aڀ_<@%;ߵY=6v-`4iM ^]\vJ$$tH3:+^J,
8s!HQ X*.pVa
˺A?v"_:ӎ]kR0xR7xT|Iy9 `2X Hu
[Ӱig1 6rlL83Ӕ
3
kG-i ɓ)q/V2ޭ)'"fBzLmT٪fʏHW5>~lA#%Hb(ӑjjm` NPQ wX*"[d%;vx/oUy9$fҊK"? "ԕ$JB2rxȅVЫڐZne^!6)^NV gl{̪Zd5:'_ ^pC ~9
3赊8O#ƕ|B.ג}KN1 D6;,t|i]'b mk-0+ }#Z^L2j+ EFnRI蕊etk@RSbä
:?Tk ׀FQӛ1]<<1r[@ 6_6VzBf=ÂYtLm߮x^:*Ό_g
(WmQSX
BOQ Dw *A{_D;E 5'E!
p3 (5a .ɫzO߽Ae^kU8 {s[TLj4I{jh\|HC \+~n
{p8А{IM$T֏Q}F{Ґv29U47сBWmMtWf&hy#_J-NS|Wm>ֳfw{)!VLh%O $Pouk.ãTi^KYl4իww1\i!UƐ=;[=rO#|߾59\РspݗU
5Y%RveuSLJvۢ *DX!cmUYoɲIV*bǽ=WJ 3쎿W%6ϛ W$ a?DZYiNOP`v5{ %|M"Cꖁ%zU: kS?41:zH2OG@a)x D{#HH:|>-XzƃuL !> 9h~ :N/|cbʥAl, 0#枦 12j *@<^f$TOd;܀0ɾ raQ$S_ۿ$е.3$_>BVF`kdy#Dp\(<ʮ )#hD2!:yNx
(0(z۹4Ɠ =!@ 8n0
Aj#ȎͰ`
5]g +R
opkϺg#GPWG } Eo?̷l_ TE_偐$f.0Q28ϓN&{|t, &l>&*e ۰l`|9'͞0=흢d@VQqreۈ
Rt-~RdG$A8EEcQ$l:* sZO;PpDLġeJJ=ƾУ`T6F;h _ sYyo uYl?Qdp{jhhO> YN1f @m7PldSV8<gLg(;5NGm/e X&j]%?[LBrzθ9E"j٥H* 8*cF˦okKCr=m6tg8ȪK C~:` l1Oi8 Ņ 2"2`^ , 5ZOˀ^p-?q,B OS *: UCM]?LZD0?7ީl)fB? tNJTĿ
33V{PϷsR[a)vK!0FI1*53Om
Ҭ{|dY]IfhWi 7/#KSukdf #*B0 Rba
KвZUPBJRDpo& ۹*70%6i:/p"@SN$6T#|ؙ:y$O$7w8D _\^ I$Oa6WI-@tc"td\!NїU^qh5sUDy~;j6f3qVh
a+2%BdLJ\q3U*?[-c}
~ [Ec{ :[` 18DR K]"گ~3aHg(P-{[ fzoXRrѮdMl%&]M\7ϋ aևKZ4MȍT}UA^U~7uo)8=9Vi>4*SZ= h}~+Hhg'/A,J.Zl=H,^drѰDz;r S$آn &xmAѣ;º%L̀ lݖM@2@Ʋ388+ |A%Zz!y&dEM24QKE*42 c,8%?[jrlIG4#p_?`.}#",uԽ02".la[zqSmRZ3sҔД ϴUws$c%xG~IKvrKtyHsë ^{< |$nz_/_N
F-nIY./䬄LiE< LJLw]0;,ȋ}3\~ر=,j2/ 7ooVi=5$I}Χ
cNq;VqI6;3cʤ\U'Eba'ܳ):q*oE Յ+]2ڪP3fΩ+uٷ A07>*nVDrWK۽R#ŅYL&lP; iX-3kRv ä Aׅ!kDRxӡ) Q3C3Iy>70Xt Q`Pg
-~L^%ZL <76 '֤7ӱTKok9*N=J 77i
2/! w tŲZ|\N`u);5D{zmV_3ҧ?uU$c!=Zg,#qCKHĽU[fC-ÛNe4)m q2ȱ !簱)PH$f`u~NK F=N 8%3=keO8'ڰ516,} ~
~gʒsxaݮ6 g)X=wuJڎC=T<ҤFo d#
z_; ҟdkmi(5;ơ3Qj ɍscDgԢF Ƚ[R >{̗hǤ(pԲbr; h:CXC /Wl]*bDR0xz% }Dx=Mg}g8&re\
ھ״ B))Zoz<:O;0L \JnGrqVx| 0z(?S ^K=X_~,^)ÉNL
jv;kJ
R gxC([NbהE
un8y ZZna~=K~wtw?A( s 0R\ߘ-NۥWYz UW-)in$ evrp<
C7t ɊsZgK T>HW> # >Uv҃;[]ۓ2Z(hJ)o)95_H3 .`d[&sоc= RelZSo?LY^<t{*)Th̦yjbEdP|C#r[vHt)<+jFsE ؾj`~Ĩ
L"3Kנ/錽Y|:Lt=6$;wn{ 7ͭ 8?@eҥyR3BE|>*6͙5Me )(Z&_NfE\ %ٟp;yhG \t,WW B7Iu#8f%-N]oğ
ʁ^#zg;
^/;dWA3=͢!nch m>#X#1HWT'cP9WF'.5]]Kz 9ii֧.kr 0#W ?'U/&3/p?~]1:92 arV͛r
feqPçw&ͣk[<)EE+ 4Du ֦ v&hO Ur xL͖KHMbgKjYU=|-C6N
1V&mY{r >/I7XAԷ$ViեI-j fh&bgEVu{$GQؾ|#0R
Hl 3} myZ zJ7Chq`5dhT?%#"} f; Rj9+(C|!/jbċ*,bp1A^:P[*ZtX@G@ĽBt;2'JR'}A{mrk!' U!RQ
VF9덩m;A9 E]_>'DZ ƍN⁘-x^ LJ;I <
3d;CAIFỴ
mIE ϶F{@Ei-v
h/bsGHßVOӡdBFLVhVu-\ H x%|c.iKr38R0 4!EQ 4Ui+v0/"*øZ\n)wXѹ1oCk. Q rrP_:4`\|2<b)K1O&۹ $§蘥r%r0
-9謧ONJ.H]UW@ٲ`ِ 9HMHHea|G#Y& Gw uSm:Qű3
ly.g~UVS@ ejWb*Qmr
y⥕hN]<͂D@r\Fql Rz M kQV>Iɮ% 7N>6ʂό)q^5N(D+ R;:tl ł=ZɶD$ XzAhLV Pe=+4 =Utl<#h҃ZsGtԳvU #C!%-6Ou5| CT̅Ht7(v. Rwj@)5|~ƖZ{T2 /;"+ _ )}+ha|z 瘭nuޏHa3[beܡ-^u8S":Wf%?]N]u,g_6jD%NM$߶
!k X[4%^xyld؟|p\ "nZm:-xFM+0ng ʬ2iU VAי$2[=wc8Kk(ayM'M@ V}"PKڳq9b #lLүʚµ\1t Nwh0]>3- X:Q Կ^K&L2i"62ck)Ng@
7 oİǗm<:q ć6(")HB`k_F2Cyށmr rA]N|wTşj JB^G &H_9[w$a"nHyyB3kOu09--im$!3YO
]Hafx? h}Ҁ?>zD\KR.E!5kF3e~b *%)̓id\0^S#,K*?{--}j& ܡCr+f9'b3Pg. l&x8:o -ܸȋefOٴ3*
# {K yeMdYtIu{h<0THl9c:\1 |g[XDkϳE}&D}0Y1)!V ny 'N#i1lO$\Q>x~UG:mE;!REh>:õr`!&^a Tck;5A6nepI N-1 +l ^GQ%bD, G#e5`"HxPO2z#p)'J^0]U N7"O~P`lw->sL%qGqc|NDB _Z iE$9*4`<-bX)g̾V9\ av"(x3k6Rc %z Vu`x~> d<vp+T|Ɣs'{7#7Rx 9/tҡ Y hC]ILkת@yvA}4N6ݶ8u x`Oǎa,W$f8}x×BQ8Ìv]@ށoX':"(h* yMaulGˌ$krֹ4ӭE1HO b>`Rf>`:a)ϯ ,8 }ϩBQnd3N;xv E{w Gbb"CE(?7J] HL&n<+ $nNjAI liC֗M-+_lraIk&PøAqd^Mc5eR|lL7x[2y K yi:*4BkD/My7q5:0é!C$Y3
"m ּL{RK+ E 21iy#ᬔ\V],ulΣ)h0aw *To l-rJ/%/Ma}
<;Qsؿ"& v
cM 7-+Τ}P ɵH.1omtuMW
e5R
k++ }G572mj9 Nonfwg
OMl4W~=i!k$vlUZ:FN%nI\Kyр?~Lv m{~G`7{I)5.邳`#Kq~ܚ0ۇ9[SU~3_ԲiqvZAx2JQL-
jL ъ ~ y4ZOkC@27{cg
e M:h?( e9 %` ;٥
bo_(dFA_ qq"{%M 3)sC_|4nm41$vdы[HCOpLse,L:/ = ٙ #mhэP
$f &sST-=,Pw E$wAL~8D^Q)~Oj I]BUa |qxɚjy'[Nkgw(}6qz6Sjbƻ9ݙP#DPnCO7 1&/v~ٰނ.|K#gg=x t1k>#в5m4TV4=Rh*Ś $ڲc:[ax6 H)rش{yK & v& {:ժR
t
F̧9dp^ om:7E^t߱-ۼ_CSP}<17 ^Z褀.4N߹Of4!a ?$IUٱwC/$YOûޝicJнW]73⼅44`y]
|f$gTeɢ'?\%v+P]իa7Gh $I*4?L60sPg&JZ4cIeOTbVg $ǾY ~-0CWz-x7Kϖc:i
@ku~ v@Ks-^JXކgj`Ehun){»Ҩg É# &:.CéJ
+MQU㨪ڈd:TOuAP>WPkC:'_ f8Ϲy K`WHhNIŠ,
_l_ Җט3`~|I^ƚqC&0Lǥ` %Pcљh]<7=DS֮VJ;$PI3s18wf+B= WPι4 C#GI4 kR'zO vrãMLggRsNA> sW_bGJ#EnGq6~뭺sc_&_c9,#9|09uBmlƱlmNq цSTe)Gj MN* ]g9sT!Rg1)Z[59>dj$ښ검&tńk:^V6ċaq-kb!Ydm)r2G|l Q%ʺJ &M
3q]^N:T L@Ik'\2Ba &BFc|FQUy|HpK]$f dީQN >ˇ7JHWҦ0ǻA yDX2 ^61ټ^U=s4L~stm{PSpK 9ӡrgnLЉI
}9B6S (Í7,Y:(KˇsyL-YLЉU /cx )+ 3(-47w PGCU. _X8*g6 12
QV^mHB:s)K))f_oԾWXlY
/!?4ѝd Ҫ"rZ( Z0*yXg_,]%3~ F~4w:)K*.c; ٭BNk% iݠW*" ɐ kE ?sn:4+9BI
(8Ow;e"A#G-?#f4yC~?-0}5Yd_6"!%i.Gs)fK['$.w Lb8ЋI갂\39Hv6;fr
z:z܆wb'CI <1ֲY L,
[#ErWBFn)˫o}0%,J
-H1alk4.
_l t/['*pɿnP7#QAi'WG N9n}P E Y{j#aF 9
nbr(Wk G Z䐗Ճi˜iP#yAۃOb# 9vf& ?ʟ]FK
s?CT ߯Le+j
B-e?lOYGӣ͘B:
[0PxԘjJ~BCGHrތgIkg7)ڨ<+Sy4Sb%6@/{e#(YFx{z,H
ـWoxwq~eMT
?dQ
ug~_4P:;\y(a
a
ʓg{SJȄfaϢP R08jrujJH061!WdbА[^_~T hOc:&yd y.j& GUwXbWrp%G"387=Vȇul\ >7}eJE
HAB?^9C-sU)nXhQ
xyʫNz<جͫUeSrP VuqSkٶ}l1
SQv
mȀWt"CR
xۋo
sDr-sQUՈ0Z)]E,uB ?7U[t}:QXCpq mjݣCmc(&rW P-(hT92њu xU DţNГ딽 ZJn%CSyGϒd
#Ǜ:,nmCen
VX^ -b5w /˘v<^#$]ADff^L75{,9Wn8;x2q0[. r%öIrĬx_ Guk~pF )Je寓#d)CC_(Sn!3RԚ/ LAI8 F_P NV5ŝړ* x}dOk1%,*w>)[PWCK4 c?Bik~es', }Z3<9D]c^4'%7+wz&^]2:%!YeXӃ@
ĠtN`>ƫpKJk P] '(xX I %K*oObd`.-_>6xtҹ 4 C \peLִ丷Yx'4ɫG2d8k5<: A9.JBm gKE S7$`g1 4L=ȅZŖ#*pTÙKNV93cg yD[vaPzo"+48Fh| >7 $ཫpLwͿ럻wfM8338_bHX\Rh {8= t>9g^ {a@ BB&o+;HN8 D7
SN,`zevwoA1̭w~&*ZS5AqYb\bcV
'
/y:ؖ HwCg=Øߌച+14Ё%¨Ʉ<6k'fb|8{}6<oզWA%v=$/O|GŽI }"fඨf5Yx0CKEw-upD˨6ؼD-\q/4*!
u &xcf=ןX9`r siِԴ:39˕֘^[| yev
H 7z 0Y'h]m}A9OGmck ߛPɥ
0x=}- y: eEmp ۈurQ|^D!MN~;ʑ3Q~8CE`Z",$ٚH\=ezr >H̹hLpmnUdv?
ec:y%]Ar"W^;
Qp=3GaO'= N+asf*:;;i8-/*i4`ȲxL}E䔂{q Kouc]+)\ ]m^i5X]PU <\kh%2 K sJҺ2PF 6d`s,Xzhg8rZW
w,-!LAUv Hd!>Jz+ _wƻẀzd 3^M+ l41BLP;
Ao' qJVN614`t V3M Dc)vkPt4xa^ + bѢ%TN /W@8!_hȾPAR!}ܢߧ. y5rZrL7L1C>]m_Ǫ)k.D|mE#6;㭝ܟIc͉9ڳt_Fx9NW =ڡ\ aHo3~G}~5X}4 @k6 R1,^f۫=r8Ws~q2p:@o _k, ?X\C VJ5!]sOQLj8yyh Ǔ]) | Ia4̤q5M 9g\|
ٸ]zd$V`D 8EE8*0QI |J&y[J*B>7k5k.hUX=Pk " ld28opdS)ܫvNٹC: GGI)jˇ`plDt -s t '|. 9拙"}Igy;cnV𠽓,:f%+ë\N\)yǠ$ݣ6fl|ϏY} ;T8\6%mMDE љ!ЧK {K&Sbt1EnsL[ .wjzf lXk\aE%UZ6$u[M!J_s̟[V+y nyk]$t5b+D-d홥Ee-B=g
iv)Jʻʨѹxv)w]l"X{{=Chяىaiו 4PQ3[)"|' 6F g6Hw0*(V'4we} qSmI
4 QG]cI
~2z/ P 5v+4L<ᴋ획E~pGO\ \k*j@f% ȻJQp0lGm =g<̚: *Ngy:Xۍ8-~ [[[&@ !ƹGSIUM7nl $w"S ɪa!F[܌*ry`rT.gv&[!S@8)?M #
r+LW0 VO>nM_]˲f RZ~"L T (S ȘEg%ܘܑlpp7+SMCapm6URTUDXՕ1dL09{Q8FVLno1)M:(ްW!/ GyWDY¼ajbJN*ԍ塝in.B$r3TWS[#]E^`p2=l!=k>Gmi,߲8XSIMGVC( ,;ޖ[2 | ¤vѸB履Sn_Ƹ iߺ8l%";n~39P[4t ysa]_;%v_@K6
$BvtvKufxPP/yw ++0]k]\Qj(x3~b ݓ{0"|Fi 2
`jnd[{f>R]KVi~e, CG@"U}H&ΔAfܳ 1Km=EaܤOl :'h =DlXw*n W"5rdWљVm]x5 _}?:
34ې51[qL SqQl6<} Zb!GvSdk-cpMV1Dn
X.T7@sZV';^$L EWTT7ܯ6#X?_a0!) PwdIB{iJV9jbLj~5$#AP`]vaIerC_^3C #M Zy 6=Q@?֏K pǮ^ "yA
!QfCic-gg(Q(§f錱 9gZ՟28ǓH*K犰)T,Ė .hnAJ~1 O /irEF.hM M=Bc&}H6**:G=;˴ 8*Ɍ#5MYhx?8Q݀ڝX$w g@D)n]~4zbcY2>7HwgF9 j
_Ѩc`pb@^t!`H#bt} (!mW҅`֘@FdHzz=3Sn֦yXӌ2$Yu`tV3%҇ +Ek
VWKE7MkU)}cƥ B vBPO7~6»}Utۅ`3
46pW+tBZ 7ݤ2Ϯô@ؔ `F*C˫9NgDtuw EmTu3,A_pǗ Po! E<a %`RQ?i}<F?+1 [ ơbQ
ϭ"Hߐ)e"qqh#~KY
<
~;,%y:"0@~)kuX^sTMۯyvP*%ض
܆y&'|277JpH[uF=p߫_?+vuDMeqk"w IJ1oŪg&g0M.>l ͘-}a0Tz~&!m.g/8B jesф(渚
lGy1WAsP)
}'[`I(
Q>h#* װqfN\Dqͬ|Ąb!ꘒdofdxk]i ŏe ;ٜ ~u!ƫgXDظ֊0Y>o *Є5 8|LҤRv<|;69{RDe@]$c3$B. -
̈́ARi );x]rǿIg6ͨ0.t +#[o ^J0!];sE?zg! zKgW.q~ Օh?=ގbkNS(.)idD];r8_n
ći)g cU7p Ss9wzvq!L4-Nˎnj*PJ zi K + [ K갹漕CYna~Q
իi
MNMFD<*S"`X>%@ mpӍĂ#̬ dm@8%k lISp:6QH&ЖWэ*
%Sbz )D uurASm]kM:C[\R&iDT~!;l"/f1粝oT (}c#m>㦥$'f#emNؑP.4m?1It ߓ1{ ĵ:*28?
j@\5ĈPM}:A-2nsF#]{N##2 J~ l 7gnK^k?x;)k
Qt*i눡KLV0U1M0@ P
;Vժv+`sU !
h8,S9^V I}lhy9wL ñ/ $Lgy\f9d dTDdYcd/քmg)D^/`ݜ_zA.'^c:5ɂ t$q2P~at - PMv `J o+.!* ANJ'O2qQ#½§XG2Ԣm[P`oM-{ODGF# W "wòkBi{,lX壿XȍʫtBcjT2BlεcvGMCoOzwIځn;}h8^C3N2b$NYNI̸
ĈA7oK4qTtw,&F "ܗwG,bku.y}7/=lBN{#[Yu"
g|<&ʮ +)-Y.obu^aZv/XW
HyRV8x#v;X
^otyLq뺂 hk68P
lY8 oF 'ᗯq-HҾ "&~K>8a;
oBj~q
v-4]ndeq 2okʝ/\98$kֆU4* +x36,1t[ St=הjT85wV0Q6gJL#- }'q xFl"qwQM I:/y uܙ8O; yE#!J%xQ쨢$EWb6j[G8!R}O3D ,>y
VIVNX46iUUr̜ +<;ğ) 254h =g{)=?DJ)
`]1d_͂"
C+N ܦ%|Ċ&ȁE iOTfH֝n%f 3p\-Z+YuNi<6'3 yA/f,3!4 `J̠pm)'//$(i>g m-l ,0|tz~q-{3 +mZԧ"ɌQFӟfOԪ*?p1Z۴ Nn_5&p4QXwر^b P[iYv -DGYa/])?Y>xFdsIn/c ]H]Aua$]kRӟ r|g nkJ&<
y"j%`M NeT37Թ@m B'M'f@#bZn 4+NףAF58a_^l,G2( 1k
e]s{zmO0`Fjƍuku" f\צ N: 3J d )Y\ qF ?L̖ fIZ_ZiIR Y+KTe_ƴt]*ֈ/M,Q#9 Ťʳ9E|͞M*
+ӽ`E 2ndQlpbS1ڏ(#5y<7U3ltYv5\ qx7A~]]?^MABؑտ #TB5hI?rApyQLz 3kڠT- ua5
fiZ6^ݏCGm?{ OzgKq09Og^ `(ݴ]_ 5{X&w hU(Ȫ|=eoX,dRXx؛I* S{h'$gj~n ƅo9-:MF9=wc
c w!R5~4uXk[0*fXܝԚ} u䠾ʄ}_: 3O"dimulА)kަV`Vj
C lP 3sѵR G1. Vřh 4wIqe5dZ9 \=
5iUȐ vҠFU zWM<!~HX+u|O,T⧊ќ)[~ )9= T :wYg rzLUn %1\g|zY`1f0(3]d&ө @"kNh1Nx`D W쏣|?{Fsn; G$\d Vb( $^1XK/ LI % LXs'kwK%^L{FÚ6/wI '$Y֣Km`Ppw N!)S3)?ٶ9H'^XN,>gAfD~dSJ opWeDk&H1u /hFj'xK_P@irqE y^i鞾Ƴ4t궪99gl[+5
9m* QLHߠQ{&ԏ!ʀm <)UdiOdqK13늺r8P
q*{fǼZƻA(ʌ#m&^m} V 2CGK鏆\ >I|pq%OIE`..^J<`+:6eC0}픫Bp| ~ ̷f
^f7-)2] PQY:)doO9 &*K^
nȂ6´ZNchv,L>[Uh0m2~ 6ٗ^B & x宓REF[[NOr-iH'/]F2Q\˸ S֣/_:<'fIW^w%x T@ECϢщ]?ѯ(߂xj}K*?P ˃E<4 :" izTx5kZl,Ykr% `ˑTC N7г*ԺHUBz$
)x[ Q3*]HS6̝>;hMYnHJ9%}1W)OĠ)k=· K4$R 'Ǜȷ6D Fx'oGPLԘȳs $Ə>flɅ"~O-ۣk|ep3Ze_L-0~wYpvf+ K/qA1#: TW*E:Umfu+V&eA |3|q45C uׁDkw5M0Hh؈>Ts`l73䋽`(9xYǗw!Gn- Mfh#Y*":]ݴ F `G-3bȓ9|a{ &R_ˮoZ]>?pO
))fK.0[[Y=zJc.1aEh!Tq~&臠
{ǜJ
;ccR;ҟ/" ]N_z JJzS`Hd,gOG(ㅷdžs4WLQ
pص =`aԘ
7hR\U>=2= (4*#CnpCRK'Kz`O`h\M$m/a2eODaȞӬq=%S_20 vΥ-[0k]eR => aF[ƹND 'g cQRd6ό[F Oi)Wy+d >āj$K4v,OS*`pWv@¡_+Jh
h
o] A.v y5͟e[6WfG71%rIMo7\4"M, AȠzWJWA}
#~ݞ5X #;i7+,3èsm{Up iXPPp n cytsZNZ} u
emkgn|
ZRF vZ_%BFJ鶴 n.ڜt\U;O@u-m%QJ 7pWd}fܿkTԅ^!R: k V_\zZd ƫ#
E"* 3kyE#Ӆ%]R "p
-ͥp-Qo5zk=d& tcmw#l G9fyڅ/FÎ"r1, FR֊e#f#2BO~58pWO_{e7y/7깜IlʞB5lx d$όtkݿb$ SHz`ۋ- y2k0!a'v;pJB<$l.~^qExLsEivD{ʹƷpy .\&uKJw였8@.Ygr}IBUA6sxJi ܭv ~G ''0a[oq Mκj2Vk4C2Wvrn~ =}X$Lm pEA3Xs. +;s %* y V+
b|Zɻ$Ȉ\Ca,jf]a
PAyd7v|*A>76w:m1+|$sgcT}D TEW1 (=%կ-p^s@|o-Tƚ!b 2U- ŕ |rr6+ o|t
L >wӪ?71\) X>bk3)ʏxIwz%a![[b'(8{[end[( AW!W"|tׂʼ&+깅iY#CeG~ט]_Nժ Vͬc' r5!0Uʈ!O3Uz.%Q@ԃNPiE8 5j]
֧/Z {7R1=q ƃ4ȏ ^VICuf]|.Pa%뀌{n[#F EP @vwt\/v|"#yAKL8w.Ti ̤r)-6z j 5yF(c0]NfP"#0R-HѮLTTG|\UWwLډ" CJ,$5lM̋V>=&G5,n&s Aw ğ#(L2 +#(X?T휒D{7!K5OLj(&QTgpK|痃IıFa^8.M
G)`ê㦆E,t>[ʁUl[mN ͏wex$%:VoIt '0(\E0AY}N (
pBj):O_S T!k;^q h?p$Z#g377{P^XDowF#pPوgYHGY2ǿ^AK'}CTj$C)3
myhbLB{RX)JdKn1v$ԥ? f?o5`83fy':.ȷ!rFq p2ĸ:
+@'u_wJLɚFlKVm?ӭ, a2+
^x|w{r5ߨtjTӬ.& >=Q*|=
@+r$qQF%$ &0E(bIyx- 2aӀ^ U9x[Y0r(
N}2:T)P* @aS0n*X t<57V^2cd{EPLe$|^o2,<Zp-Uv(xD5=ݘ+Q&UsD _nҢyg >KOς5iIgfR)*!;Q3 hf1uվ便X6mJ3`v+lX9D
1(Aq7I)i3l: #U1+(oQKs q 7iFMh01[ޤ QE_ kf)z8dh|wkػ(gUQ '%
)QMMJW=I(SdZ#L;J &Nx⺨!m29C"g@PkO$$[ٶ6aѵH> x_ NLni7o&DA+)By*UBw>l=̹c-
Y*@DzO "Wnrᩜd7`qQق< eCr@>K z
å}$CZVG"2 _0Qֺh".EO
T-Џq6Sm%D 47+66m;Z\ H\(@c@Ku;Y,4o_I'ޫq+6DC2m(?h&l "oȩp*3҄ KO O~>:>XC_|Ad5+ vjwqz*P%z`3 oàfӊ*S
BWa}(2~_EOA 41 u:M71 륪8e汑]^W '*?SR^fjzK sB
90f=q1P#) 7HU8[7j5 ۦ.(xZBk
@E[(@[mg?AG7-dqv9#t4X%M R_A7f(Cji@a v5h?i~9xk8K^ k*C/ddq)tH*kHψ}r!A#Pͧ4ye#*vA9p|kO۾-uC7 \+S1?1Š ({[OXjOY M' KA>'x?`rN/Fv"H!H9&L R
昬->š=cUxzpK@qu00ۥ-|=k'"en9ll{Bi
Ui}l-o(&2,cztʅ? =B{ Fs0+-2q cIԞQ
-2g }P֝B (L ]gkkFwb&dxsL*|ԧ",5( ןc[HY)
}Oud3*6kiZvA5 j-_l VԿT
a3 _܍i%tF sq*$>o4Y ;A^!}_8:de X>FYyhycjNY/yB\߇A Zxn$Y ualp#Z#nW fťQ#˅&l
S! 6{%+bA㻁Rmu ByAؕX q7" P{56`Hi
D*f[6XĎ[_L}kS)XdKkdl< EI(X}_s"TD즳dl@ qWۢ ,'Edwe//O8 >:/
`igqג\wxf7j{&,$4r_j v hPpv3d~ڵV$R{; 'dGQ_nyZ=28,H!=&yZo
@-:[(T ldED. 1[6Ra+ {mÜ{Mp2SA!xs¶?KQ㴹s>N hߛGm }DwO k
˓/`[V.q}됺LɧĒ;}3xM۵-H|2@ں@'Zk"Q9ԉY{7&Ϸ ;c
',UG7$5VH&ɐmY T@\u
oetk]5Yyfr<:ݛjo !vs{R *#p]k+ts;'+*V 8$JHWlE
{ AuObi8ޡ>R/
9rƫeuFRUrBKi',&lןVr($*Z孞n~6 nC
[YCJ1h8>mJC :ǩx doRڽU4MM4j%;OuI q3 {\G89P.!k "ƫF8H}ĢTYٓTsS{z.bϮSwD1QKGVwJsı@/NoJ\
t܉!GYEo39-ywɣ)~bij%x I:}= ?!0JrZ?H7~ʟµ2$xTozs}I3I1 Z(RI)o>BE
asWvO$ax?g
i4˱[|ٯL01|
*y[Z<]pwWp<+gp!.\؉PiDZK|~UIx" O[:Eu`>h [Z.m KQp>A;ݟն)GekOrJӾ8 Ul!!onx.DzAPs9*NHNr"0ks/)+u7,G 6T`(2O3]d<&z.H;'NlC`Ĵm!{)a2u[6 zHt e_&總C&j !gN%3Y y .0xmz!%]ӛmF!muVw+ƏRqA؞OD@!?K+MRg*k2cr ^wwib" 80hw̧hʙ&/1kD:1zZE5CM^ -vr%_(SR~v1]ce(م_s)T:I\\z9v]X.Y~e7c<%'
\>AD:@>|F6L ^LA7;l7փȑwi;Qp `@ aV
yT@TYAܒ;?]FVOn~
m)XNu'_$%,Fdڞ3. SiW*jME_0wzq\;0 mfVJfgs<,VATV86eQ}T4>p2Y_ ?U, @Zn叢ZKeakcQ;dAGV"1{q~00w6:H]F.I0i7Yk s!!L$ /5N
)=k&TgWWOS,D/q|^v
D9a#.|*jάےK^ )4) Mʉ;Ѫ(" _80/}1Xky L8,9.Ruaun>;T3aEZ}= [M61IQ/C̃i SmUDݑ R S'UAQK\ˣIvjC-碎%^Q96YeMi.UlJgh-W*
3@ u
śrMt'msm aU
;Ą V[M6MTq ұn?!~k2+
]l9jb|"h)BԒvND21E &О"عcQU
f'&~tލM!еWޑTpf(y)8ՠ^ղ1^* cJ1{ Q!kz?z0?W+i"12=vatSf W(uE}+GЖ0FG;96 ƫjbk-fIC?B|\?:4&#J7 ~^:na%46}qO9deķYhߌtjXSxUIzzM2g94cR)vzZIӠf 1DjmeݾYWzɬ}1 ViSjذd'.ðy}.DA3udO\=iC[u 874bkgOgXR!謧Ԭ^nM,W$~}ah]Ogs{}Roc BW`IZ@f2%6ri7
a #rWvd"4y-ÊbxLUnQ?w$EYcT$8S160((,SߏW eq$O8c\E>օ
_Cv@}-q(O҃@{bUY 4uݸXɷ;B
7F*nI U|Ǧ I CvJt"/}Σ gMl|O ZQLy5*E N6 f$.jP2Z"^ J.?(]N$b<$,5Һ]{:_
O[' R1LIDm2
z +:87<,n,ڒL9\tl1Ui7]qMXCR8/MЯ99uW_"3ӹ;Q8PO{WҮjur,\:^~nA[5VD IfSJ#~J~賏Ds 2M Ub5pDVK
ݞX7{q6+}pLXq}`fd4~ 9Lns4 ;{d5K"oI)>t<
:+_ 8s_ũ5a1Æ=u 3ToLV@ ։[P.=m͛.IP77}y
ّx
z=)YP@4cEl
w| J˫џ% nR:\?͓Yb 7jK풀Pq >X+2
;rQsm/XV \n?zhԶԻec
{Whv l(B2L*f=%^K-p:eEVSUk[ +h4%{NL[3Hu^%!nM*KWkхj {ԻwvZJ%NjnTv'neɗ~Ap1]oA= t[=;
C~.! zO ۲d|mr [9$iQ_1\_L96#iTuAV/)./( ^ILCgoLʼH/oZDDV_FfgZY,.0$$Gn=X0O *j'T( Xpy
w;s9usolfXVy
04y釀p̭t3NY f-/ Y4vPL:gB:\g W4H!테I/ۂTEw
)NU\ j֠ #
b >Q4 &$O) :̏U nA( kVLܬoeSGvvJ`j G0 `K`w86'c,hd2[Řjiimg<Wݕn"0H J CnO-~ʼT[@yU;-^|h" œ Ϭ
fdO
9l+kH,O
|xش@ 8EI ϝ1m[tk( [?S`:T iQVB%rإn\>b0Yn7UWO\j!fd?hq C'5I!a<Ь~A
G̒
83Q< SDXfh0&|F/_3
@yxyN>dP8t rbۨ
?b}dk,zlP [/Z,% CnjW!H/DO[,/$G@+Kehnk}.\Bkc4{;^KYoDHŪ=#}/oI(k?R 5bzYH%lZt=DFOD @9p&\ ݜD?(bfZȉ7 8D{WdPQXV;W W7\ɞǰcvo.>mK#%@q
HE
/Yr]EI4)p q6MUذP< ԛNC[ tƻvjH 'TJ?9-FGf`0*G\pv0xI-6t OanfJ y:rk |OΆ4dVBGI8@XXU(S=taE־snf鋌/vBSeP@kLX;3MGӣH44Rp+9CkCXD[ uXډƵr'|=9N.^h&sBV!']r(IZ?)AI(kwHq~JX94Y[GVEǃ>ZOys85J{voS (h.-%>AmIwjJL A$34&҆%; f\~-)b[c,c`|>?pAi
pK:ŏ({`S%B<ܶMF-"oEj@w
U
>~}p
n8 %_
K' ^*~ IYxEx+X}Qμ ,ip`f<2:vTQ#C'0X[j>M'K4 4mpf-G[|mN"*z RGBP?6 9g_QG;ȅD~M϶e ©?~08s@]շc
H-6k .gdOP,JPm0ޜ}*"cy$ l<[DOEP"{ok6-f>ՎőORU(/Ө\A~cI9WѤ )b
+&VKs^ˠ "0Ir-^3l2w8韞l)5`B[]U. !q/Ouܫ~;G׳֛zypd.s8B
х ? 'u[T !EΝו% 8)=%J((cQ0'Ѿj)OtVY[{h v p4t+I桢ȮBIyDGd]91t R8 L = En ~0{* r)[,6CJ:M vQNʹ[=b xay_4(FoiA_^K VqFSZ/xc
1 4-la{ܿ=":
Y
kVatӌ& qkhi@[I缗iW)N$| a5|``ZdAEGk2j.}*{\tG(z %|/255;UВ|`
wMLRaoO]2K]ÄL5x~ kj]~F(5)JpNgIҨqp_xyrH2ǁ lD
cԇE˪o a4g~^PPHtd11uY)7K6q ? MBLgx"ѱD<>=e]Z-!MyHzŇS`ro _J!&wrQAacMTX>lv
+S_| nɈO)R]xI }l"9jBPa\@sG2XZ_{Mݸ42:E={`m7oI\W,V X6Hyy'JuVȉJVA~>_X3Q 9{ݢ!C:HzLSjEn!ogD
CJ IHf.hdG `uORl̋uZGhaCЫăv({:ϑp\]& ?SI
+v7e_0 vޛ ۴ƨ!2J0T`iK=DÝeϮLJj`$j:1 nnTef9NfG\X(!{HGF8ӽl*ncm9nQ7 QA3>>,WaEє*o sڶMwDkߍ_(AqTQ{"I l
\XaFk42+T 4s*]ܡaW)8jt!h&|3)Ѿ6sRQPS3S^d|*&C2E8+V;%6Equh>\ZHUuܘ9!T P9ؑeywp(M3_z_a!|v2@WmiVݞbU +Z*($QJ89etsԭ^bz1ˑ* D&wu"\~(qo<6c#Q[iRT<$8 bʯn l*I猬
M@rs bs5L^ƆnS!"3eGPcE$Xt ,':x" 8hfmjz mpOI^1Z
[%³TS\㏄BZ (̐@@ؖ ) mHo>iZ)v3i1Ux+{ }VSL-#`*bњ6FuEܡDmTn Pܶ掳 -Hqhh` ]dg@3Σ͕2.Qxhߒw7"ᅗv{W 3_<_G3BW{ifpʉ;P2N,[}*l x-pO]h"}n҆QsʹpD7x M& o'Qq@n#/XFF׳K{Sn`;E,Ͼ~* Ԇ,,ia̩Mw dDvKM`lU!Ol) X#i/崝K8|3h 3>[]`5b.4CӺRs( ; E5
=M^vE:چ ) H-/Ebxlh&9CNL ZP9ӫڸ3Nj?nouf_-\]ɰ a y
(Jǖp{L8a+ā/k}nel#źA+轍9`HH ֍M ? F8Mcg:ά"
;@m_WΤx qY#%A#K=Y^ ϊ릶[&bJ[q8*[lgqO;O09Lmjc Ӷ 8}Og)'v00֟w~jH/r%Fb뼽_A;h$|eq1ι4JpbgߘH!g<( ei O
UFD{Z=,\JWqۻQO-'@Ͱ<y
'Sk
==?bQ3*-KqM?v?]z` ]uN #rm;84"lT) $)oi)
:b/ Wjf1 9(S"`m bg~0QMmp]Omp\j
W
. kRIzt}d\m I[jD.Y5wPpr+'>DhC߬D2`ɤlMs~UVD ̹Cd X 9af(y .H+ "Z:A +.nrF )9_ Եr%" k%PQ%:V}r Ic o~?4t zs#I;"Ե\ɧ5B;fcNm`
iJ0P4p} T]kB;.h0S wpZ-RuGgb8.>>bw_ɆJewz-[hB XnW6cа+\KVfc00)xjEyd娀2}3Fk8F$ ^^$J4T+Ri*]ƅk%q=#湮8҆9? gI9oEL/UL5'8n[abҌiG(R,`E }Ho Js8-'7UD ˔sړ, "{ U{>EdV NKo-!Ic˨VOz/D`2 lQ?h'я
w_STCQZ)i deg+fIM_.ucR:<1:e) <_F*d%Ƅ++>˺mhL9럂սm wbф-c:y"KIl42&5TmQXۂ紵zPgX7
8~z6 "nb.Ug6iE*Æf CT<_ HƿX4;,LDn,A9 @;;N{}
V
H}L2nx(ATF^.>y"B͚)NHd5 In4ALN0˼kH;eڙAm7C]\ԛGKF◸D:ܶ b:mmޘϕa`R X*_)FOܸzXɞ;f+MO-V09
E[Uf1
q^^b8f 4M\A߾ȑ7ц㗶$$
eA,"onb'2WT;G D|Ŷ(ĵs xJdl~lv<)C"@mVWwꄚw|>)d tʎc c[U3*
Uyƨ FYN yo o7e2rɐSݍe^ٸQ.fYG_ʽyF<>Oh:+sc=U[l I98nUw0u-%MN@y #U~ ӡuN5GFL誅9NY)SH,$hHW0&9;m
3sjnZG^/:çlM !-LGMMҙ GoCe!ϠIÛ"|kR9x:#GJA]bDr9
Xx6bwbUov e
oŮ~Uq0 ^TtS\ݩ4Ow^DqxշΝAdO BA`MP:JD6p 3{Ҟ
D =OJ\1{7\;h!s6TrxdCFn!؉RqD jpڱzApQ9jDG
;^JO0 ʼYڵQ"7"Ji,lHUݔ_wsO=#e+|u2L{ Xj}Ͳ).}KĪR-< gwk)! ?_Qb5.k?Nη.$Ж7&U ۲mM* cMh;A*'6 op' 'ɼh_>YzM3*<.%lY[2m3xnV\2VGp+1oN`{$Q)Zb+ӋV%?s= y8\:< ." Aǽ=5M@k\Tsp_x; O
;,0a1ޝSȶwJ`pXEٓ3x5%
ܟW })+Ga0v茍W6 _ȋqz\
Tq$[H&/Dy ҮuL 0Gi>b-G7Oѿj=wI }B$;uz |܆Rc\ L ;=@42Mu9؝-H<%q Y-}#q^Q۶ ) {md*9uugcӉ7m 8!ލqv|_G|0M'fo)-s$@El|"϶g6+1+. g$y \u+KN^ w
>$kh}I,˹a}Rⶡ' !pw;P&>hM. }vٟO
Mx_ iC5p/ U!#{sQ.坼H]^:84ri u >xO}2=z{MOj [| ~e]!T5+RTಠXi`UדІ_d dJ ma2g 磤
\b}o0e}r
7xEQ*Y`+tek˯
0ٜ1ZIFI,aH
W!&Wvߖc㗻'6 "l2QzI!.[Dg`:ٻ%mfK?xHogt #U{|} .3q2tmxMm6Lk$$/?kFWK&J{~ʘ59 _ke;K6yM({)
N&Ok't>6.;K(&Vr i}RudAo ?ylD(f쬅 !ɭi\_sX{?iT&?X}ӒUێWWa"+ 1zŶ W;?V ̢ar* S5L=Ei}vUN21 sCm/>0$Fs 90BHeYQYXtN"D 8XjEBbkyf9}&ْ`Ĺ$l r) %q`i!B(8"AkvT:e8YqoªK_ֆxf }nj=gOJn0G AxER@O/,[]?smsz@\ d}KY
z?}}i#,4|%ATENN`
}!%'`/{kK) xjJyz r.}O
"~%*س'г*ުɮyUY R:s>QcP\E9]Ff &$.
n9?/) UM T>S5tYyF~ /vwD,<ہ-Pg
~&9 ZV>FCESxJK~Oqx#Sn)͙A>;|3f\m؍ I0y ?z캱tlH҉~UZ͖
'KW#.uE_(M0RDqɭBGZF*8#Tz Ig{6KE.fs3;r wU]⭦^[fug2Rm4EuMfy*Vs!r}hpbx/ljJ
5]Iy--0݂F3PCsG9 TMgb`3@}:p,&UXx.<YpYŐwRk0;"0ÏKJ8_eMΟ nOӽ`y8 CQ9݆]dW$!Y`%Ua߮vX ̹.** 2lϯ*QT}T% F'1jpW+0X k1inZfMQ9E Aӹ6"0gyIh3rIC{&[ )LJIdإi,pA/5$bH#M$VZ5~pH.S$ց̟\ub;8UE欄dsuDA~W O,;2',Sc1ct,PsEH
RX (D;\!7u;o^CԨf~V TiH©_!JEx֭s^{_q`cA3%c$̮c&8/R͆\.>̴2,5)
ߤTq{Wݠ"rso^m S)!ȝ}NyfYP:[Co̰S8y@3hOt\0>aCl8`FZ%ɘ; -ޜA q .%4&Jnj>EA
Z0u~uh|K`I: _/C糘R2. *U# l!8M߰&9xYw_XE/G4&,-:),E_9b:fS |LMiKO1G3l:ѵEt7W ,? 5WQW..;3 iA=?KQ1auȅ-+I KHrև` c.ݲáΨqofJ<dCEP\VGT*dQ<;"#u%
ZfX>WScly)Y#ޭTU" I;#"Jl
LA?kƎl 3 1܃X~3U9C/lnR"RU|ʫ~?5 ܰ: N=SBbm^s.
ȖϚ+/lQ=IQ! { g$01蔇1vhOS2L|8 TہxN:咦'G]/V|nKvitw]k}j ,AK
+Ad`[٠;+xK)05yK+*jR_3؞aR.-5+,q!W9uª}>/PS_\?0uLj'P4zv {kP&8BLG_^f5 {f.ڳi-TRŗP] hp2S
}> .VJM
7q4ߜ=\b Ds53ןkw6 27{ 'H/eTE ]Ȗ~;h:F|&A9m
9[E vTP5FtPpx8]\q /CUM];{9
% tL|({^$鬶ղav%/;{ M:TKK #fIs<53Zŧsv~
]ʜ$ W*冩%RVrD";~ {\C"$1"-)A3.cȌeUp gw 1 +! ׁE^$+5cܫt
KGF_c"#K9Bzh h-~$*gTj1V0x-etٺpn>:S%Aht',"j"ѐ[ ۮ1^}yٹ'[Eo : q{ HOn Qx .q^^=~ ^M u5g sDK.7g|HEw}DJӣP$.Ӫ #jK3miL^˷"J)(ʘ )+l0'^vyyCB9QMFc騺w\aQ l,ZzU L e+eM&Vio=v[A!P钅DXv0%B=.jl֙6IǡNަDEV%@zrgV;bTr6aUEĤ7]EYtdUMZ)n Awkj1ts ȨQ?TihH.@6v2EGcHa#ϳiF%vky[sf2n2[>w33*
v:nr95KC$rU"=l 4 /"~@æt/Z: O'7);4{C-Ly3ਈ[P%IWQmǮQ7 BtUD) )wvE bH{dQ ˼VǶ BU?.+ 'r Gʼ: _>'( wKŖO0i#$Fͬm܁z +F|>GՍ?ͫn8q `]" u1w͛}U>^ ~}á#(v@s&4#kB~k-;5uٙ>\$n+ 7%L(4:eP7lY" ǘ\MA2f
LSР6z9y9{m_
l$PSQgDJG]IK{WnMdtϠԬa/.bDբާy!fVR-9To7=wQ;$apN}^+/,xݜӄ ޓbNJP㱊 ^KcWΕ"+y}p_Z.Lx& KloNX - |ԕ O~ US{&##i
z{Y{: 9ߵ-xԪUYPu~4lxq#'?HGLĴj@PBX[bЊb iI]E*:d|3KƮ z%m "ʼg* /A{Rj9f?M.+kKu |Z$ bbԆY".- *y~?۷+ P{z
o'Kl LbzO/Vfǐ`fr9w= XT DaE U A<ıˉH rGk,uu9 9vՆy {bYN J>^AWt@vĖ]BmA-7 &]E
5]LO^9ږ )?$Cf9Ik 6tg5`V y*@βU86^vbF6{!zOlW>t1h($o >tUz:2;FjWĦQKvRrO
O%^x3|/a`CMeڔ̹(L_Ng@Gs| _a C & wVI#YojoAƙI]'%t3ڗ [.Y/IHnƍ$l
Mu#| hxBpcT F[dW|c3w&zCLDPq
fqvF0 ΝʅHsg
hAFߥ3Ȁu$[Z!*[Co`%BDF. p36p~F{[ @";=)Jͭ #
ee}F!lJz^Of/ZA_NDL\ 4m \\q[_} ŒizƋq6yV\oݨfB0HN(
Ȣ^ֳ8إ(>ʲr'+ 5"! 1F2ƸnY"n
@6&{ZErAYs'`숰r *̹QFq-pN9y#a>Rl~90^#3t<[/X "k
{J
MMF*裮)jk0q{L<0֓ |fpaƲTᝐZD0I
$JTeP9@|nх$ ;F6 a+`D:! |wӦ=~ƺ?~OW;U\1Xm`>k2 oh8RGI[|sg`o͚OU<8*,: "T;C9kh| VRQ A#ms_Tj!%WT T֙. Gp$ȡ{sH9iSI& dnIRxJ!;[Cl$ uu}%P 1i8YHJTy R,|- Uu&7=ty}_ -wœy1 c!}ШJ$*Y3>' r7ae/.xn/|t{4CkXDW55!*4mqfP\H̆@ A&y%ln"
)
o>`D : \`r*D6;ޮ@!бh:!Bx hˤOFWdŌx|sZ;zd˅Ї oB&O>WsEK$3J٩>
5\q.p[l{
]Aƀt9^YMt~z941` G1S0F?o
|F2 *e Qyc[74[iɆZ@|x-nr PNCż?Bu1|q
v M{g7o^զtXݓ0,e~2c%s=HUCF|I S!JʯQi$ )
h֘hcJp-}@ -hŔJ r y0%)W&A \bE_[A3Oú3Gs8 y,1eȱ'|sf Rvzvج# RׂmZ3PD$DglNpPq^E*8Ƌ}B
w~i *0P.M kpyyYBcZe)PJu˰#߲9#ߔ
Y"IJ>MuJC'-Ő o23_\J8b 7x[Y ɝ M6UO -M/3E`Y+vpJRe$DgX Jڟ)HPᯞŞ;8Z1G0A `R?#6& =&l3li$OMT98@Q 2.D[Ss*)L)ͰNUI+m3"6B!
71rs#W?cQG qt#מ7 e h q| ~6}8Nкud #KMRҚ`9 ]LXo8ŭ44RW;#I!~6fe}.&BĤ&B' ;4Jz ҲGs4|i`p:Q >\kz]2l ڬ=8qm텗YFx C S5ffГQľ=`
řٵ:XSgQMJn#*vgenWJrD.t|} `t?dϛJ%ȹ34{' IaXnKuމ+ENn8'A8TCu e.Y+G ѕNR ,-[~7nf+%K]Ν12wZ( e%%q NA)Fn|~#n[C^N-V?AA"_,Ȃ$F; WvQ{Er5cn_]I8
(TG+w[Ė xT ?yZ?/ {O*-)$)=Iv!x,@-ѥr>F
,f/^dY+ׂ֞Ө
>&J.c$/Z֯r2ХWxmԧ0łJq"Ă;^[y=XAlluJ@<X#3h.:Ķ&OrC;~HŬUХ eNvvC3Q6[⭿5E Ht lGSqʱoE z0ǼF,w]T>%en *a7} vq4sjvxzl=k}'ݑWQx%;;E $xf40j< sYUi*'F8|Wy:} [~1pb,2D:pZ튂і RW
)h'?
?0k 6 ޔpS\+s!"? R EF
laT7VQ;=mm@+Q+V
XyTㄶdd^MuPQIt.1cmF 6DĒ6A :4]40 P\GgyVRgO̱!n(Jth`,w?u.mWgi,<;,y->KCJV=u%C9ؘ>:,v"]8}'C.ZqR?.@
h)P`H/\JoMƊeIwaS47ZZiU?\ x La.ixBAiWFP+ dg'ݛCRj E K/oS@Ǫ4IҸb\lwl4X OuQC꼇H+ڪTUiIaGoƽ8;w 1xD}ռCW mAZ V|"KͿ ceD6
Xw
R'$FL"HՉ̑uMvGxIZ7U4Cl|3sY_ 3nܦ6wmA mI#Lap6%2D٥P16Ȟ({)9n7f *q@aTqVĜlw'}w-up>\ci| sj;SYNNJnٜab_:Z(U3h F;lуoe 1ƈ\I 6/w;6_
M .OV2jթ{;{* VTgXj5Іh臯rF: ̇: ߙ/;ΒW#fBM[Ԯr.{nxS<=6#VJi6a r,"0
^5(,rAaֆ&9`_6 ۂwjSUF.c1Nj}|8*~ sI Q~py x\sȄ"67Fu 7sW? vh(5@gfAqlN7D4R 2a| 6m
fWU4/_S%*^;-sI^ilθ|gϹJiT1oV/C^G5ѝZd'7y W<ǔGev@KVCJE
KqFsQ^µPȑ5 NYIGB |X&b^[(C13s?#|g!c {5v j`쁽!I[ R{,LwB^mK'_T$ ~9鷯? x%}HcO뼗Z%/jL"I1dk\rÓc 9Hٚs "}F{
%r.Gu4|q.pb?7ȥÛ%ݪgLaѐ/O,EE*b\i`th{P~.G:˩fW-3(4/CEOD "PUf 4U HBAzYG `v1R7%P%!o"vD/K" <uzVؾTg{ zh#D.}aj5azpDbi
hB "ewØ_LJY"f YITl3j}D⇢X3Z%˟[4k/Fb~l 8 ٗ½ u5I12aabV2 Y m0*&d#܉NC
ƭDGGǗʘW˝Vnf$"8P$['fI|e<wSSK6Vo30̣HIwudQϓyZ2{SKG?6 P~VK?4.kFו;|? ^16l)~
6?\F0(pY]y k ʜ#L
~7Q@RA>d5KD#H;'+} [ fk@Bhp kcSX'ҋq`i$MYr 1-*LCFSvb+yW*s $: iuϼ |On
UPY@Rna%bS%~a Z (X-F?Z6B gŸqO[uhι+[
ALK*Š 1adL\ /WURk?&~`[x 9fcX^ '}5@l
{D `OVͭ9}J.W$n
w pE_*KMDap׆WbD*'SAG`]$U߈m54b]mX{^ݻQ;+P^VE^XG}%u?r2 /ZEdK; g]'\g ;,P7[O<×>)*n_BD +B(!QX1}g\ Zb!KVsO: Tm8&yƱ|phU q .wvN(j16@Ud,MfKܵy>
>O>^ٛ6Z[ti 翸eDya: XMRǻ %+π߸/ii`R[y}[#Ϝ1 C0ԋ_אktIÂ-m3}j=l{7N3$Dďabmfv6fJT%}c4&>P^<\ٍQ.ΦolfHtmv<|a&}/, kߋe~r'7sbsVŌ ٬fVu{}y e["-ғ7S:-E$:S\l~ vpeݦk_k9co4]=KU'/㩦`[ zhǺ/$,/5($ ZZ(% xiUY0f
J; )p{OrXCWek0D|F9BBl){㿺HW[4<Вz5Q(_Ot?"-m$s Ol
P) 's/@+d\rhbB4L?
,Ƈ օU`9 BEQ Ţ K+= 4q!אd8B Ҟ Hl+(r N$|HC
z,Ue&h^i8%JhDuHlU[XI u-0 6 m`CQL܁@$ mUMD5I \ m||>W)Co^M5eC{s;l?Z T&U
Ǧm #
C߂87:yZ"C1U8A!ѦW%\3P7mw:G~
?瞶r?n ԡg8Zʫ~^'8U3dȰ!`06SG\ulʾ创C 4~kaw]09Z:)pwN$UPnL: q4#VƳ|G̩aNaY i v Z)-EB]mkX+)?y'x7d-
vBt1l1"? !
Uɀi('c
]D]Nɞ5Ox` Ck LiټO?i8 ٲit!AZXdA 93/+SppSebv1_IjgMLi7s*;ߊ =[KPq[ʃ b,Rgi^>ax ..=E5dJl !fhRd#.Nc
vc!msU9FC" Exy~m f=X/DR;nU$) !|yF#"V3444F<F=]I=Qj Jye9~W #[C)y%r݈xOMr%ZbZYTҾ6Z^U3a]@0%*YћH
YӮ^ - r,ШI.m0SbWU`B i2qeiJ\kU(bQPǸzlҐfbwElLzfg 9/>ItEV)ؒ<<ؐ!ղOrŸ̔!CG>͞EW`(D脲 [yOAgG)H5T_SJ\}Z~, >H_&@ I|;"8;ta䴲`W>U5&$/6
}
k!=8(? w ,XW#Nf
; [jtj?gkoVHLyLi74DMaMU7'hH<< ?'д ͗Sw6%. SΨcNgRQ@ANȩPbѣֽ"60Fw 6p2Q0Px_o"\4- &lm*xg|?9S`gyg #% -T 10nqnc6m7GzʓW,TZxUvsusZ\!Ex?! Q+75 ,l8#C
' 0EhߓsL.O9yʥIeJx`?IkNؿ}΅_vѭ@b? T(,(<z8[5/XNtRezPێ]oZ N3yxu],} 6(sat18Y놞qME M~ÃL^5c v=nom
"fY1 /C;ϛL
S,3[E
JEDW](
w+8L 1|&z e7~y-;8N~حGԡR-s~os=jMYHʉЗ1|·1wQ
$PP''7!)QsO!
lf̏ͤzhh5?N?wڬ S00<'A.U} :8 Qa
S?x7^8zo|x&fG~PgS5h'i1 ko n_9U8X%8NUBWت՜-٧w)e?l0 V9vg_#M oI'~Sb(UTPF(G6'evhG[ 2Sy{`~ C1l?]T;>D_Lԧn9~Z gY)nfvIiwPڑM
H}NxG葝fqg*^h6h1Z3noWBƃK ͑ SYD=X+ML+BuRU"w%rp|Tj]Vߺh1
,irVd vqΧb.ђZd#5Llg]᭡]҂~M JâG1åo`!^v9%#݃w'v)DHB? u4V%7LCC7 Rliz M?VhV:L@(Vj@gY+_4l')sB뗆pRRw;,74l/i趛9띁,Sg <##?zk捠]j,Q4z?8 igtYI
Lz0:N'&ìm'G_%VeyD!1ؼtLIF" @QDK8ȐessԷXJUf1S^d `=& dM"!DyDNV[hGD +Ҏ֖7Ō10/9Beb B=YKS(wg8t[IYVC^B na!9In'`zu]LtZ/ YJ2 BJWMڳP⢕D~ИFNق%<: ۵
pY~# Y@yqUSr<{8ڦ b68ފ]3t98mlVQ7/_zEMn2B D0 [yLB \Dg8C.ҧ~MCH` y*8
E2a~ǐvJЎr pwlE#L;S32L}\IQdj\O?4Z /Oh KHK1; bJѕxp5jh2~XvLkd?hud+cJs8>#?Q2 &&ļ}{(Ɣ
kx*W\chyχ+Ņ#dk7f ZQ.0nsPE O&& `zafLLU2}Ʀ:
s hxYŊ
$Ta.*f nK>:M Z DgzT ,brl|"L"hq@ނd#D ^' "tc\B9>e\[L[P Yun |Xm
+XMr;$tzYtTd
LR c"P;W.C qáf?}XN.(دɈM6~o#m/
T( JpY1x+
WuZ`&,ن8?5dm*=J)aiHZ}[i5f{z8gټSt]%)%b$笼V ]erp]fH i,#vK[YH$c4 ":wMؤN v0; ɍg!g˰ȡiL]ɳַRFQsV{T-ǨR, Ex[i
`K{c jdѴеvZ&'CzCfC^"ս]
3%1 J S|
,jVo`Ծ/ؒIzs0e+
FV\aQ 㦀hxѰk۰pIj0Le!|'N$W - .]5 ^4tGBxD"qE*Y{me:݅ayv9cxѵ,5}f67'S}'*j`~&/E-$ `O7 :W)N)#)/ҐM2ݮ kdNЂHf7!Oic ~vCQ<). t۶BEUW3X:&1 Sf `.'IM)ߏb ZI6J\=BA&*B &MSԄbccL$ƿ\2RKerjIӯGpTY_m I# q2z ɟ/h7x +W#R17vw|!{= :#ʷGv aHneTAAnw Ͻ7e5< !=$Fk `Anws?e#q3 yw}QxL_d9 @gG6k.ʓ)bv"y 9
{^K[qݭfim;WA#$0n? /Y\U
ɩ rr ]ONәuKFvB< D"<[o/DH y\Vܺ#3A%է5XX36>5 v J
j+w~#8{1z kœr<^.ýqgzı AR?n- tM49Vpv /!ݬ+
uH-Z~ O$/R%]xq#"VŦ7Im Q lS(:Z zqqED:ɏa/ W #\9,;N>B2H] dùC
͒yؗU]y(C >~"J0&IFgtNÛJ
_ŕSܪrۑ- '\p^U WÉv8O!/O+9LaDZz"\jjmYαS>F*L`xc69g# .xGg\s,;Lm[8S5Y*F; H
ʦ!.v-oط}Feu ,&mw,9BA:NA7ۿ> _%'!-_rMBBmS~+
X3MLzWfJ ٨Vs_=@ 3Z=g?p |ʬ8:t"z>
ȉNrjK27{LV?NOi0Tc-k:PePqpd z@dIpa6[ƶ6 /9$3Ve/)>^wӨ.R@A9 >S5=nI\
UV>*aD`uI:
l '!lR/?pVjL͟/> v%Ϳ(9_[KcMrs'
vM91ح WۛTmZqfTWTW!d 9(Z
^K4/GJ^u m?
ʻ*#ߓE!
#E&KSEG-=<[#o/mc3|<Rf|S9%ؖ\E;Ʒ|yX!,^{Cx.I`J؝ZAbձzR5 " y1fIvs'[ygD}
71_i" n\|MȾJw>WxM]iN{QRwK- %d=䆨"$s~2R4{W _]㦮_ xIRɑȧjУ[}J
]˚*ۗhBdK靓ժTťEfe kS;2raj6_"PWLf|/͔ZZ~: X_s-W{ƎiťLv/*S
h^Y\}BByG=샪Nk|2cYͭnC?ݥS=ZĽ7.Wp~RoؑTk
NӦ ~Yb\}G/BAAR˰k _tMOb ni1KFX^͒EbdfFW dbnrC8< )oʰ$\i?x8dZ5ہ3{a$L4IMkUF~5W18 hYhșz## # ނ"c:?ad& lb| "] {|VQ jso`xϐIS
s YO +FPe>F8{mK6/$$?:>_n C8Rk$:bReBTJ;cWQ+GI+ x\8ch]l8r~?
PzF";p?] w/np3<0"H< , 'PM]} gya: "ϖ9NCӐM%Ke<>+C *U(Aϕ{eY;A ÔNb;EGv,.
[ZTs]e @N
D"p'Z J0PuZ i - V{)čȟBV QH;MJжDvjy6w8o%#5Z
^&-Q tX. g du)Z1z4# R"݂ ME:t:T%SȗJGA݅@\)yK~4[+p<#l&3*>[gJ!68m[ 'QX"(f[G c&B!0Jp ̦ڶ'a MOVt|B
gJ4@=`
uင5qH`L{tL1C\B~6.]jt.Iwi38@[EfՕlm Pkj ][ r5RN! SS`+ꇲu6 Ŷ}0ћGu| L5
G`jܰ="U#}^m.ɇ0k'8&J1#wkܴfg~<3Ƽ[}6;$yA)p˓i8毸~x([qթg3?N%(@35+>]SB9uu4L6" 4 :R7L)Y ]M\(
:,e;ۥaǝ||]'MCd@HLc0d㐑}6ʃ=s5ջW|ތ0jXSij% "ny:y,7sӄ8t0?|G\6Nf伯=H J(gnTDwb8[i6*_t| j=@ԅKRIA]۽/?Q[^
\reGLh )Je18v9W #\r*Y̿9bs7e0pJuWcʘF
RJo)ĆB誮y5Ob& u="Q_ll(V@ U7T ("q
TZ;GP#1la# WBYh ] i,,pc5 $|CQ!wg- Ukx/Kl[[jaL==qَ O2)) ZjjCR`,OZ&tP" lo Rckp/V
d[71nM_: T@-EXf{ «LbPGV_!c2#:W|+-~?E=jB\okjs^U2MeOYi9/y(*Ƞ51
qW&F,E4)D:{N UP^mi[+8T,!)e_=Nebʪl]\62g9@ؑYu bL ֮k{X_4Tp8t>j1 9!/*Vt
V{">rmy=teߧlj[TtuS?z[i_fK?R Ho߃\I+7,d`&lu< ) _%0R(pIGW? b:+#Hbch 1:)X0EmϦ4KP=ضWwCƤj̏9e clͿ0Pnr>( l[e]ߴ>M!F A!y^/A}*eΥH9B>nvAV] p8~ȁˠ$ B
5ީΣ5G VO% ;?y)֨ny^)274ƭ:`#pB KƴgÑV!Kw
#s BM,:JiP-LA` GMTW, {9u|_ gs[
x_CP8QC
/OwMZl"s_7-ɯ](Q tEodwԻf9ݏs: ^^Jof w| `ɱB.b%:bʳ CVԵV^Bk91H9JcҰwX
ay
< P@~G
cFbʝ SwUT{ds̐U;e-L#U!-F`ng_93"$+>9Q'ƕ;*P]+g2!"*f%kn!bm' vf$/WMW>z,9/ šQui@ F ѱ%okkEb ͔
mVT|_zb69x2] kE*.7A{Y
L輆ޣH J3,mJ vEz; U#h"l,)=gtɍ &8( j
.\\'\jR;c9Rs
Jmʭevus`v];@{r 8GqbдW+
]p\Lfs
P tF7xß%wBSΦ|ƕJ
X_nT?0xewEĶ$QugEOKp6H6w=f/3ԗsnRPviXbpxv^
}l 4Q8>Ζ
:g1zH)KVÒnzpUu.T[w@p_ദ ? dML!p+Ȼk,mԱ6.C8J9,&NsMr Rs/I |p1): !M۫3_cNuum$Q~Ew$Eryȧ P49+]qa8?(N 9#iH b图yqB3GWD,Ne
fRD[Ew#}'
ݥ, M,FQ[ ${9>"Q+
|/ 5kXKyG(1nkLpo-Z) p !nPŒzӸ%!Ī?$RÖ&OQhr:
Aɿ
s)+&=3kFgI% X>(0@w@u&34̂3 s"L cm$@q5!7lS&mRk[3(]aղB#D!&rR==v wI!#UhY :E v`zƥRBAOV ذ;yBd$xQlk
/P{Tw_,iO(1ٷa0eb|č*&Z|
~lɞKD (L%Ze"b2z-'Ã rב
TZnIP 1f+nWn